Extracted

Extracted

• • Target

    b927cb105caf0dfa39e7d095ab25d7ea53cc35e936fecea6e4a93d31174d1f58

  • Size

    1.8MB

  • MD5

    ff7aa229821fdeab4283422f885a9ca6

  • SHA1

    a7acc05c0fa2242401de5ea4efa23b588ad2d439

  • SHA256

    b927cb105caf0dfa39e7d095ab25d7ea53cc35e936fecea6e4a93d31174d1f58

  • SHA512

    91b4e57b5fa1a81abb62c0ec1fbc37a23d4e7c92579f4035eaab6973f810679593e602fb57fd62b39c1751b83a9eae7d81ce5dd824e5b5c9fa31cb9d736c21e7

  • SSDEEP

    24576:W7YfUB7F1931tbwYaOV+rEfv0xwT3zxNOt4XigDSCuptNEynEsqqfD:W75B7FDFtbwYa8aesY3Ot4N7G/

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2