Extracted

• • Target

    04a4c939069d40961567895f539aa5f2b6d8e98a1095f6a17a45aafa1613de35

  • Size

    2.0MB

  • MD5

    cc63b9c7489d07e6d4fd5074accd510c

  • SHA1

    d56cd93a4f4c181ad057693a77ad86fd7d41fcf1

  • SHA256

    04a4c939069d40961567895f539aa5f2b6d8e98a1095f6a17a45aafa1613de35

  • SHA512

    2dc3b9a470d822b7e607b07c8a7ec93a73230a77cbeb8cf485bc2b3042c7afd6ea3c10b85adc8803e339cd0d45cd63a76576bb47f01edc624f3a2d3fb17b14ac

  • SSDEEP

    49152:7QzHt472DxJtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtTtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2