Extracted

• • Target

    4dbbd608e84512b310260cc7400654b819f815a422ebe618522b7cd748f65c6a.exe

  • Size

    2.1MB

  • MD5

    9c66e86d61ce7b1d3d2b1a5b2e63ecf7

  • SHA1

    b1815f689392bde159101610a04288114af4c811

  • SHA256

    4dbbd608e84512b310260cc7400654b819f815a422ebe618522b7cd748f65c6a

  • SHA512

    c239643f3baf1dcda5626d3a2bd73bab2cd45ddf13035332861c46c01d550704636de7ccd64df4604f65154489cad5a3c9ad52f8100cc75e6028ddaa92809fdf

  • SSDEEP

    49152:N6uDuaS9refKsJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb9XstIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2