Extracted

Extracted

• • Target

    decc9f9679f32c8757a88f0be304d70ec4c11fc9cfb273fa4a867459daf9837f

  • Size

    2.4MB

  • MD5

    6f0d04d9f7f24c3552543445c3665574

  • SHA1

    2ef93fb68d15a8b361991aafe3474450dcc53fc3

  • SHA256

    decc9f9679f32c8757a88f0be304d70ec4c11fc9cfb273fa4a867459daf9837f

  • SHA512

    cdf27bebab7f33d72020d3afb0bf764269c9a2c18b2d23aeb4b8af027b385bb9c95982797d6c74b6fb908145885d628dec2999e573d3617947c83bd8147dcdab

  • SSDEEP

    49152:wQc81KnB/a/hNT/dNYa8aesY3Ot4N7G/:wDta/hNT/dNn0etD/

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2