Extracted

• • Target

    3a66e87715918ab44acbd17d50ce96e3f0818c2e9fb87c133b25c8515fd035fd

  • Size

    2.0MB

  • MD5

    c4da3e0445e672d9a5a4ce37d6b44bb7

  • SHA1

    6a4301a630e7d93d27248a82489a3ab8a54afb70

  • SHA256

    3a66e87715918ab44acbd17d50ce96e3f0818c2e9fb87c133b25c8515fd035fd

  • SHA512

    35e1e9b93bb574e7dee864fca74fea5144653b06b20de24d70abad5af54e384e929e08a3c02c6f8b6a2a836a3df1abb96ced195d4dee89d86be99f70643e6d44

  • SSDEEP

    49152:7QzHt472DcJtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtatIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2