Extracted

• • Target

    a565c5ce6df8a1d28a9823a409adea1dee46fdc51ac6ffb1d37b9ce928f3a733

  • Size

    1.8MB

  • MD5

    22e189acfeaa42090f18eb43f0e769ba

  • SHA1

    7d1d7200a99995e30c06324ed572530b5d489008

  • SHA256

    a565c5ce6df8a1d28a9823a409adea1dee46fdc51ac6ffb1d37b9ce928f3a733

  • SHA512

    c706aaa65b654206d07f3c7bd36294c79ce524e051bfd7c7bdcf04ac3bb8c5226738246a23e8c55e2ef4f2cf8ac10457307c8087845c5fed4c223ca955321f89

  • SSDEEP

    24576:FBfuZfeq6sVO6hTdtTF+TxMoxQH1Tj4wtjYZH1DmoYYzi3WH45yv+OueSJhm9e:F7qFHJtTF+TxMoxc1TU+j+dAzGwlrh

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2