Extracted

• • Target

    a196c14ae3a671eed1e664eeda46769128e7600bd0e4fac96beb9fecb789ea24

  • Size

    1.8MB

  • MD5

    d0430790be25ce4a3a45af0553a3d057

  • SHA1

    b2150a6adc261868c0816d089c840d1a417fe8ef

  • SHA256

    a196c14ae3a671eed1e664eeda46769128e7600bd0e4fac96beb9fecb789ea24

  • SHA512

    940dead6a4f44a4fca8760dc62b054261799670091d81c8cd996d2515ea85b408cdf52a33b7b0dfe409ea8e1b6e9b605ed9d2a7d67cf15828d144ba68aad4e80

  • SSDEEP

    24576:FBfuZfeq6sdO6hTdtTF+TxMoxQH1Tj4wtjYZH1DmoYYzi3WH45yv+OueSJhm9e:F7qFPJtTF+TxMoxc1TU+j+dAzGwlrh

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2