Extracted

• • Target

    4185510e684de45d50d5f0635b8ade980df3230ac7a0cfdaeb376a023e882fc3.exe

  • Size

    2.0MB

  • MD5

    60fce5d097889319755bb5090d55300a

  • SHA1

    60316d1dbfe417efcd17b309d046948f5f1a11e5

  • SHA256

    4185510e684de45d50d5f0635b8ade980df3230ac7a0cfdaeb376a023e882fc3

  • SHA512

    556eaf9bdc2ab5243fddcd69e09554fa1171d8baf366797b8379f6745307673182f43cecf118eccdd556d6ba86faaf7de23c81c77a1ca87e7f8a14ee0a2d63f6

  • SSDEEP

    49152:7QzHt472D+JtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtUtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2