Extracted

• • Target

    38bbcabe8608c99d9f662dce0c6f140f572f932a9ce012e2ed401e14ee977888

  • Size

    2.0MB

  • MD5

    ef1fd91b22ff3154e018641e3858ca48

  • SHA1

    6e99e1c3404268ff5af88caf899b4795dfd613a6

  • SHA256

    38bbcabe8608c99d9f662dce0c6f140f572f932a9ce012e2ed401e14ee977888

  • SHA512

    160c4be7bbe9852181934a9badad8d0752bdc4f42e332364318b5299f3472a4979fb6534316179ae529348e32a3e78d515a3313e1c9d0c5734429a2a768ef903

  • SSDEEP

    49152:7QzHt472DzJtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtltIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2