Extracted

Extracted

• • Target

    5242240b621c48673edacfacfbcceb6f9453d7cd043fc0f0667106f50f7459c8

  • Size

    2.5MB

  • MD5

    e3b991af10c7a3b5dd80b7a275071a43

  • SHA1

    302e65d87864466cb3738776e86d296ae0ca5476

  • SHA256

    5242240b621c48673edacfacfbcceb6f9453d7cd043fc0f0667106f50f7459c8

  • SHA512

    3d7b5d4d2b740eb419b98fc07592c323b2bb4c7416503ddf4354a5e78b1a04c6e17a3722f44994ec4def3c345a1c4d3237eeae75064b44858e4cdf397f4c0f51

  • SSDEEP

    49152:Zcm4081qpZBUbHEmJjsEAQACR07Q3byRD8aXY658:ZcmmqvBUbHtpfAw07QLyLn

  Score

  10^/10

  stealcvidarstealerdiscoveryspyware

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2