Extracted

Extracted

• • Target

    ba25b560ebdd410dfe51ab41b5a7ccbecd3d3491ab556a47e747683c22552d2c

  • Size

    2.4MB

  • MD5

    c195f865edc7bafe41a46abf49a51d92

  • SHA1

    dd5def2ab5fa5470ee67f2b2bb840a41679381f1

  • SHA256

    ba25b560ebdd410dfe51ab41b5a7ccbecd3d3491ab556a47e747683c22552d2c

  • SHA512

    5e44ac1490da7a91313de1a8a8a38c4a5f941beba3bbb83e2b3a4ecc1e21ce0556150108468582097f7e39c2cb8f61749eb41b517c635e142e2f208356bbd432

  • SSDEEP

    49152:wQc81KnB/a/hNT/dFYa8aesY3Ot4N7G/:wDta/hNT/dFn0etD/

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2