Extracted

Extracted

• • Target

    bbe7750448a9b225e7012c705f12c8731b6c77c9e8e84353d8e8fd36f00974b5

  • Size

    2.4MB

  • MD5

    1b95a8bcf102d43f3b4b7222a644022f

  • SHA1

    6112880c53e81f6956f24ebafd2262964aab7524

  • SHA256

    bbe7750448a9b225e7012c705f12c8731b6c77c9e8e84353d8e8fd36f00974b5

  • SHA512

    2aa183d069ec7a426809fe0b93acdd73bf053752c4aac7eaf1ee402c0a6f58e8e92155c64d741d7e1b20ad4892a1686487314a06edd410138e3bd735c4b02b63

  • SSDEEP

    49152:wQc81KnB/a/hNT/ddYa8aesY3Ot4N7G/:wDta/hNT/ddn0etD/

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2