Extracted

Extracted

• • Target
    73e3e8ed3f6cdea0e2f492492cf1cc682d960300ac639f6d2250f7e2fb12ff4c
  • Size 1.8MB
  • SHA256 73e3e8ed3f6cdea0e2f492492cf1cc682d960300ac639f6d2250f7e2fb12ff4c
  • MD5 e6c68f9d527554cebbfd4b525b93c074
  • SHA1 b089243ad3e3dea90ccfb1f27dffca8a8a5478c3
  • SHA512 58fee7ba40490e16256c29a86162cb931c1740708415d5f1fb641627a6cfdcfad16de258fbef6f5a9f3d3c48d40079cdbc9cf1d0d66642f1863f7dc2e25d2c2f
  • SSDEEP 24576:W7YfUB7F1931tbSYaOV+rEfv0xwT3zxNOt4XigDSCuptNEynEsqqfD:W75B7FDFtbSYa8aesY3Ot4N7G/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2