Extracted

Extracted

• • Target
    dfc523c9e1b54abeb667e76b2f692d5c7e991071b1905069c8c89193c84adfc1
  • Size 1.8MB
  • SHA256 dfc523c9e1b54abeb667e76b2f692d5c7e991071b1905069c8c89193c84adfc1
  • MD5 f232d9c2cb51fedfc01f09ade4abe425
  • SHA1 ce4b9355cb563a2aa0ef04a32c458bed2274833d
  • SHA512 1ed96cee557056d097575e304e964894afd93a094d7e63f49ddf823b0e03f73d1794c459da9752b4af7e5ad08d520414e4756b7428db61e2e2a0928e42bdb061
  • SSDEEP 24576:W7YfUB7F1931tbJYaOV+rEfv0xwT3zxNOt4XigDSCuptNEynEsqqfD:W75B7FDFtbJYa8aesY3Ot4N7G/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2