Extracted

Extracted

• • Target

    e3669e0c7411b8076593b7c5fe98968339f49601883913b7476f3a8fb1f18d9b

  • Size

    2.0MB

  • MD5

    ee67d296437a97235ab086586d28062f

  • SHA1

    ddd30b333808033ca6ec274f359d1ad3724b7b3c

  • SHA256

    e3669e0c7411b8076593b7c5fe98968339f49601883913b7476f3a8fb1f18d9b

  • SHA512

    225f34d878e709eaa3ebe7656e4648c27a2bf08647cd85d58fdb5e3ac37d9eba41f87555110728e84bd6ac6466d79e9d4421c04c68adb20eac50f51181d15d6a

  • SSDEEP

    49152:s4K3x1vUKJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18KtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2