Extracted

Extracted

• • Target

    285e97efc72084742f239389b28d31382dcd9496efc0cc129257e33826b31273

  • Size

    2.4MB

  • MD5

    fcf50151b62c80a071f6b9d7a31924e8

  • SHA1

    944155fa05b10404162aa7831a2e54b84f14da51

  • SHA256

    285e97efc72084742f239389b28d31382dcd9496efc0cc129257e33826b31273

  • SHA512

    eb3f725c16d46c5a0c28084d770efd6ae59a4f05f8d9bc09a42f7bf17279e6f0bfc343a7d04d0712f510c5d545962c2c8f01c9e0c75d571557e5de8dc83bef89

  • SSDEEP

    49152:jxIRJF1HL+VdX68kUeJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68detIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2