Extracted

• • Target

    72f8c8b85e06cfa56aa3ca24fc864bb009b337fa372636a329c4c16cee755984

  • Size

    2.1MB

  • MD5

    51dfbc9d4099c72b15e45fe817edede8

  • SHA1

    8242f36d9ebc1571f675a7b5a3147e339ed342d9

  • SHA256

    72f8c8b85e06cfa56aa3ca24fc864bb009b337fa372636a329c4c16cee755984

  • SHA512

    28375c421eb315e7abc5f8dd44a713d144fc66d2044c0919ff841a9cd1720c8ae055c35d76d4081ce2835f6cce6aa098ab88461533ff0a6a0d1b3a2f8ab285f3

  • SSDEEP

    49152:N6uDuaS9refWwJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb9zwtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2