Extracted

Extracted

• • Target

    57746607343c3aa305b1544efa221a158098a853d454f77c894d9e22735c690d

  • Size

    1.9MB

  • MD5

    1be0560dfe62e7cc7727820a6b8cc7cb

  • SHA1

    2460dbe14ef667aeb6a321bccf0a40a310b98910

  • SHA256

    57746607343c3aa305b1544efa221a158098a853d454f77c894d9e22735c690d

  • SHA512

    9e9304c72e822aa55c17efe26e94dfe3a000ae5e01c825d93a0c1bb468d6e9867b30c10e9e22894247dfe033677841c1659ee64c1dd2e5c99bdeb9ded6a6a050

  • SSDEEP

    49152:CdKfTn6vGJtTF+TxMoxc1TU+j+dAzGwlrh:CdKfTnNtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2