Extracted

• • Target

    78889e694b687e2295be269aa3590ce7a10b154091e11fa48b37fbc47c0abb5a.exe

  • Size

    2.0MB

  • MD5

    a67a243935174069d226856ed2339707

  • SHA1

    e51d9e40482fe5557c348af4c8dce899b68f882e

  • SHA256

    78889e694b687e2295be269aa3590ce7a10b154091e11fa48b37fbc47c0abb5a

  • SHA512

    ff5788674bd83139c5e844d8bb90696cb7099adcd07fda6451e60d16d3b178e4b99600d2e80226fbc510394cce8a7639ae7824f97e15e3abbc84ff306d00e6c9

  • SSDEEP

    49152:7QzHt472D6JtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtwtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2