Extracted

Extracted

• • Target

    7e216e8ddcb2ca22fd855281904f5dd8a796834c80f720bef151070638724264

  • Size

    2.4MB

  • MD5

    d29a928dfc99e2d8897fd7ed7dde7962

  • SHA1

    38a58ac20598e6479496fcde85b7cd8953d8af50

  • SHA256

    7e216e8ddcb2ca22fd855281904f5dd8a796834c80f720bef151070638724264

  • SHA512

    33a1df50530ff2c5ad1f4274547d4821e12b38af26c9f9188ae96de72a5519d1f30f0c47df7c2ad3f919b299d3b1510ac6b4d5e9639deae4843fd7463cb56268

  • SSDEEP

    49152:jxIRJF1HL+VdX68kUKJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dKtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2