Extracted

Extracted

• • Target

    35937fda69bab6d2315ab21fb0b3b9fdd1760aa32935263e00d5be399996b1fd

  • Size

    1.9MB

  • MD5

    422a1ca423d331f23b2822941aa1bcc4

  • SHA1

    966b4f9c0d8427e2707245dbcb8cda2e85236393

  • SHA256

    35937fda69bab6d2315ab21fb0b3b9fdd1760aa32935263e00d5be399996b1fd

  • SHA512

    fc9f8e565463209c8123c319dde74afa8b090edb122a674e1cc8f073b8af5b11a28db9293897d33cf9949abcad8d2cb6e5b5646878b71abb099f559c99558949

  • SSDEEP

    49152:CdKfTn6v+JtTF+TxMoxc1TU+j+dAzGwlrh:CdKfTn1tIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2