Extracted

Extracted

• • Target

    29a227855e9c9c046cffe43de5cd6d9c848f11a758542eac6c688a8b87fd4da2

  • Size

    2.0MB

  • MD5

    060de5245f56049e7a329f107d9ebdce

  • SHA1

    c28bcdefdc0d3d667baee959e0e3bb7c6a73d47b

  • SHA256

    29a227855e9c9c046cffe43de5cd6d9c848f11a758542eac6c688a8b87fd4da2

  • SHA512

    c0e1c5263b0e838d5b00555f831d357cc76d5491a4071f2bf4608512fb7efdf9992d4f8125504c5de927ce55334824375c82c209e8b6b0a9edce0eaa02c86f36

  • SSDEEP

    49152:eqtdPVosJEcz/+VHA58ljrIY+96lJS9bZ:e6d9fJFc7jvedZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2