Extracted

Extracted

• • Target

    7382e2d12a0f1b6cdb9ea2ec8f4277c19c2480b3c973387de46f583cec8dbe77

  • Size

    1.9MB

  • MD5

    ab0f980e39b9d1702c44fcaa36c2b228

  • SHA1

    5ba505a1415e8cf30fa6e04a392a5fee6fd4b1e9

  • SHA256

    7382e2d12a0f1b6cdb9ea2ec8f4277c19c2480b3c973387de46f583cec8dbe77

  • SHA512

    af17ccad2274d53fb05f5a4e5585b2fa273b0a7191faa7f7732373cc93a51fa3b2d0935e4807a465a2702046bac2e4c06d889aef3a173aaaa579e3519db0b5fe

  • SSDEEP

    49152:CdKfTn6vGJtTF+TxMoxc1TU+j+dAzGwlrh:CdKfTnFtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2