Extracted

• • Target

    31885996a51d68692d5df7b7c1fe8d48f87dad45ed6a5fa9a6d93681a337b642

  • Size

    2.0MB

  • MD5

    0e081abf4b82c918848cf6148529adcb

  • SHA1

    2dd8cffea57f544ca66e56a0cfef46c293cc6e7e

  • SHA256

    31885996a51d68692d5df7b7c1fe8d48f87dad45ed6a5fa9a6d93681a337b642

  • SHA512

    b33492cb9e31c7939b6b4b83445995ffc7238c09a8464993233266251fab41f0c9f34a88b14cb1e6941bd6e9678d793392b1c4c06368ccff8c427df36b23397d

  • SSDEEP

    49152:7QzHt472D8JtTF+TxMoxc1TU+j+dAzGwlrh:7QzHt6tIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2