Extracted

Extracted

• • Target

    1b6310d4b99134b1c8d8f42eca9c137e9b2ba8a325bc824def53e1f8d5c7234b

  • Size

    2.0MB

  • MD5

    1b049fe8c40e08c046c049b57df3373d

  • SHA1

    af55dc8970036f67eddb8bc588ba6e0ebe9a6605

  • SHA256

    1b6310d4b99134b1c8d8f42eca9c137e9b2ba8a325bc824def53e1f8d5c7234b

  • SHA512

    0336b2378f7bccf89c6d115820f6f8947a609b0aa7860615fe26cb4dac4bc7a8e553867b32b074000d28f0dee7ec80ff743f90b27480051e04a8a6651175869d

  • SSDEEP

    49152:s4K3x1vUGJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18GtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2