Extracted

Extracted

• • Target

    1a67aeade6c08cfb2b5970754f96aeaedf343beca1a9111dc577f160dc001458

  • Size

    2.0MB

  • MD5

    18fcb670549fd83c96fe7c660f6480ff

  • SHA1

    a4f4d4e22c6ae812f7606618b8b51b0f3983cd8a

  • SHA256

    1a67aeade6c08cfb2b5970754f96aeaedf343beca1a9111dc577f160dc001458

  • SHA512

    05e515e0e591f59198ac1764c9099f2b3f6f924a5e67545572d5861e155852144602fe95d9aa900592d6e1a8bbd4ac79c048a967af60e5b223270b8d4ea10f4e

  • SSDEEP

    49152:OePpQEhJtTF+TxMoxc1TU+j+dAzGwlrh:OePpQEhtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2