Extracted

Extracted

• • Target

    ede246dce0aea6f3d29c26d37941ba2eaf94fb76b373d82c06fb637760faf45d

  • Size

    2.0MB

  • MD5

    63045bc0cd72dccecc0deb41974379be

  • SHA1

    c5e55097b6a8c8ddf2773022e922e033c4138a7d

  • SHA256

    ede246dce0aea6f3d29c26d37941ba2eaf94fb76b373d82c06fb637760faf45d

  • SHA512

    795b20f9e5d95eceff2ec5592655ae8ccce64bf4205365075a982b3d5b7cdcf3c4365cd562c7ca0b72a3b2e65648f05c50a79f4c4031bc0e6de22bb83c0ef0bf

  • SSDEEP

    49152:s4K3x1vUuJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18utIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2