Extracted

Extracted

• • Target
    04372ab66212b646a8a8623235d5dafc9f138a42dbeb28c22d9cf4edb944019c
  • Size 2.4MB
  • SHA256 04372ab66212b646a8a8623235d5dafc9f138a42dbeb28c22d9cf4edb944019c
  • MD5 b2d38ad09a8f913bdae881af4ae07046
  • SHA1 229706e40ca8296bc4a1aeacf7e3bea34136ba3a
  • SHA512 4b27f8d9b3570cc7f4f2591bdaff8587b1a92f64c52cfe8b8e5334b3804207bf1bbc6bb7e2613ca08f9a5c9898cb7525311234259294c80b87fd4883b7b6a5bf
  • SSDEEP 49152:wQc81KnB/a/hNT/dJYa8aesY3Ot4N7G/:wDta/hNT/dJn0etD/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2