Extracted

Extracted

• • Target

    01c33d0515f30d322d6ae611043e13ebb4b6fc1b9a31bb9ed0e3bc93adf6b4b6

  • Size

    2.0MB

  • MD5

    d7786417bebdc3947675cd7d3899040a

  • SHA1

    50580f213d6972b331a764024f3657d7dd8152cb

  • SHA256

    01c33d0515f30d322d6ae611043e13ebb4b6fc1b9a31bb9ed0e3bc93adf6b4b6

  • SHA512

    e9228d11417272a4720312192fb34dc6ae31ab2d844202a972122cc6e46663f7b97953f79e67d0cb7e64a8d84eab05672f0edf28548defc8aa1cdf31020edd6a

  • SSDEEP

    49152:eqtdPVosJEEz/+VHA58ljrIY+96lJS9bZ:e6d9fJNc7jvedZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2