Extracted

• • Target

    6645a2a059abce5c9b62c00922b46280af9a951e73d17af6fd54d57ae8c5c6e7

  • Size

    2.1MB

  • MD5

    1377bd491c3c8613e5d5b90e817c6e25

  • SHA1

    57be84dd4dffcb3fda00451633e4046c693deaa9

  • SHA256

    6645a2a059abce5c9b62c00922b46280af9a951e73d17af6fd54d57ae8c5c6e7

  • SHA512

    82e02a0b1e08994e30f8f145ef81aee584c51c3e0b34c33345ba78f58771647d94f07138686225cf3817efd8077d33ccd36a537aa808255f8a1d047f56927cff

  • SSDEEP

    49152:N6uDuaS9refSEJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb9vEtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2