Extracted

Extracted

• • Target

    ebf0a2b48504013795a31526b914c09d1c84e5bbc9638c4a5e6f8cd1c02d18df.exe

  • Size

    2.0MB

  • MD5

    94f7884d2a4d8fc6a186e41debc75e4c

  • SHA1

    56f351ed1b5d39c4e78dd0062025bb3440ef5161

  • SHA256

    ebf0a2b48504013795a31526b914c09d1c84e5bbc9638c4a5e6f8cd1c02d18df

  • SHA512

    04775100a00314d0acffa74da756875992b24d9d3823bf1ccd1fe308567dbeab989752d739476b9b637df780abea25335d6e544c55eed7a1e5fdd6a601b8372e

  • SSDEEP

    49152:IFno/jfIJtTF+TxMoxc1TU+j+dAzGkiT:IFno/jAtIuoITsdZT

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2