Extracted

Extracted

• • Target

    d83b46ddb754b838983651b38bcd55ccdd09cae1e79ea9c0e8b3d0c01e2db59f

  • Size

    3.1MB

  • MD5

    50be5d01f679a874802ddaac7c5f0169

  • SHA1

    d8e512434a94b0e123d1b7e0f4f4044252d7f238

  • SHA256

    d83b46ddb754b838983651b38bcd55ccdd09cae1e79ea9c0e8b3d0c01e2db59f

  • SHA512

    24e252b66ffe35845a03a5553096a018f91d6b3d0a36ba3aa0afab9e006dea35a14075e860b34a7fec9b7d34fd7a8e0516d43d9306afd70ee9a882fd27634f37

  • SSDEEP

    98304:yrvT3E7GFI/apsT+9w0+xobK8U9Ve7MpSfwYfiJkju9wxZmcp4/uV8rSBgXmVVKJ:i3E7GFI/apsT+9w0+xobK8U9Ve7MpSfk

  Score

  10^/10

  stealcvidarspywarestealerdiscovery

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2