Extracted

Extracted

• • Target
    2867e0e869db5b5f3e15fb7c9745412d4466a5dc4611a1bedc87fdc4eab96e2b_NeikiAnalytics
  • Size 2.0MB
  • SHA256 2867e0e869db5b5f3e15fb7c9745412d4466a5dc4611a1bedc87fdc4eab96e2b
  • MD5 143df55ba94e448b3ffec049c1317e9b
  • SHA1 d3df8eeabba64e052d59158e1ce569fef09441e9
  • SHA512 1012cff88f96b0892fe7a4c15e069f6f50e4b1a73bc0a07bb5837f6513135c8ab77a3f6b4f10f0b91a42f382793beff7f805ad81b8f7c26204b20982fbc67a04
  • SSDEEP 49152:s4K3x1vUuJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18utIuoITsdZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2