Extracted

Extracted

• • Target

    0dbcfce9a77b407f53b36954ed647b6bdd56148dcec8af90ff0ca7f980aa3f28

  • Size

    2.0MB

  • MD5

    1babb458bd44f63e531ef3417d4a08a5

  • SHA1

    919ff3fd54451c12e38a1057c81293baf73a882a

  • SHA256

    0dbcfce9a77b407f53b36954ed647b6bdd56148dcec8af90ff0ca7f980aa3f28

  • SHA512

    9a3122691b3e485ecae9686ae69beb3455eb0a6fe0437a0441bbbd3ceeb6175d65b8691b6c799783b26cd227389320ef0a26e1afd4226828817df278de5677e0

  • SSDEEP

    49152:eqtdPVosJEsz/+VHA58ljrIY+96lJS9bZ:e6d9fJVc7jvedZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2