Extracted

Extracted

• • Target
    fc16fb413e724e1062fa1834242b4e401a205f4e670e8160dea6009817504ef1
  • Size 2.5MB
  • SHA256 fc16fb413e724e1062fa1834242b4e401a205f4e670e8160dea6009817504ef1
  • MD5 6853c792f9e49611166fad1423170e3a
  • SHA1 f1ac017f194323b45c623f15d9f8e7177b8693f5
  • SHA512 1f5c7a1fee8d64a0bc24d58249a4b73d30b87d24932c9340c5650c5417df0a78839d1aa3695bdf05845b76e2ad6271117736d47f95ea28b202ba05a810ad4148
  • SSDEEP 49152:Zcm4081qpZBUbHEmJtsEAQACR07Q3byRD8aXY658:ZcmmqvBUbHtDfAw07QLyLn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2