Extracted

Extracted

• • Target

    adabfb0bdf16b84992d75198e641ae1cee694654d1f572885e87650ba2d2b09e

  • Size

    2.4MB

  • MD5

    91b44d5cf129fba188fa963041b62574

  • SHA1

    a78a8fffdecc3629890a899588205f67090c8266

  • SHA256

    adabfb0bdf16b84992d75198e641ae1cee694654d1f572885e87650ba2d2b09e

  • SHA512

    3dfa06f41ff618e8fcf10f5e8da3153cb6fd3e4ef954b259685fdb69c921521e8c152853b5254e9000e3e3c4e5bc95a8bf094359ac2767ca6f1edea5eef0f1a1

  • SSDEEP

    49152:jxIRJF1HL+VdX68kUGJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dGtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2