Extracted

Extracted

• • Target

    5b503bd339787800313a84a45e4f4c76caa24b7f12de8c177b247afaae0fd91c

  • Size

    1.9MB

  • MD5

    9bcbe36dcade7a1d71cf6198ad7fa14d

  • SHA1

    36a6b167b0001e8a0c2529604a30b4c4b484684b

  • SHA256

    5b503bd339787800313a84a45e4f4c76caa24b7f12de8c177b247afaae0fd91c

  • SHA512

    4fa698b4acff42fed207a67097f8455bf7ec4ed87125c2880e50e4f689cdf5ce5c5166e7f13c258fb2da0b264edfa0c29113179898096e3d514b496ba5705e7f

  • SSDEEP

    49152:CdKfTn6vGJtTF+TxMoxc1TU+j+dAzGwlrh:CdKfTn1tIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2