Extracted

Extracted

• • Target

    f32075854584e6e2784bf131d04f6ae7a0b52bd2bdf1b21c42d8fe02ec40ab41

  • Size

    2.5MB

  • MD5

    32159e89550f346a047fbbe29d27d3eb

  • SHA1

    34d032fe57ace34c825a3ebc5ebc35b3b6a6a034

  • SHA256

    f32075854584e6e2784bf131d04f6ae7a0b52bd2bdf1b21c42d8fe02ec40ab41

  • SHA512

    15c8ba72e331b2c0f240c044aaa73acba768e3ca8be1496058efaf384c128945ef9e343c9640bc68848d2719d7185535017a90f8c5bd4b0e7ce61b86c9e8bd3a

  • SSDEEP

    49152:+BX5/0mLBI1JVLJtTF+TxMoxc1TU+j+dAzGRX+:+BX5/0mAttIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2