Extracted

Extracted

• • Target

    012c606a4c778e8382081474e2ad3aa66c62a5b89f82786ff4f727cd519416c7

  • Size

    2.0MB

  • MD5

    5491f72e5ab92e3412d733e506d6a82f

  • SHA1

    caa09ad6369b5775075ee9c9f0564c50694f5dd3

  • SHA256

    012c606a4c778e8382081474e2ad3aa66c62a5b89f82786ff4f727cd519416c7

  • SHA512

    95678b63cf35ab74891a61877e67051a853ebeaa08182e06aa7d542f9ca7338c3636e30154904a5d20f5c89d49075d7c4fc60f08b1e17ab133b548b85c5a46db

  • SSDEEP

    49152:eqtdPVosJEAz/+VHA58ljrIY+96lJS9bZ:e6d9fJRc7jvedZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2