Extracted

Extracted

• • Target

    4e8e0745c51a4fc3589d7d6f894e94e06e14108e4d72a37e3d80d7e81e0d63dd

  • Size

    2.0MB

  • MD5

    0112d0f3f370bb3276dc5eb4e4d7a632

  • SHA1

    d3aa87f36f4a8956020fed75746ee54a1beced20

  • SHA256

    4e8e0745c51a4fc3589d7d6f894e94e06e14108e4d72a37e3d80d7e81e0d63dd

  • SHA512

    661299178fc76044b9e10e047435c0ef127e07ab0883c2c648f9ac008ae282a04a7acd83bd0e5f5a4ff81cca302cc3efa60adad10e686cba177c1558802b22b7

  • SSDEEP

    49152:s4K3x1vUSJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18StIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2