Extracted

• • Target

    151213efe5438396a7f3b63972f03db2e52a619dfb99cdd985c9427ac1c09c80

  • Size

    2.1MB

  • MD5

    07778b7f8dd9d0a2a74b4e8ed363b078

  • SHA1

    0643b2a56f2e58d886d0d75202cd954012f06937

  • SHA256

    151213efe5438396a7f3b63972f03db2e52a619dfb99cdd985c9427ac1c09c80

  • SHA512

    d92dd6d006ab3222b842693c3c69a6b999491109555f4fcf5686ac4f57808f379e1a0019c7c656fae5189f49f173b91069218f77e8f0ad49fad87a599e9380b1

  • SSDEEP

    49152:N6uDuaS9refeMJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb9zMtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2