Extracted

Extracted

• • Target

    ac1419ee574abfa919bfed5e3043b1ee45e8e158738dcc73bf3d9c8f6c883802

  • Size

    2.1MB

  • MD5

    02fd894ffd0c025ddc5b2ca733b4fa9f

  • SHA1

    036d7833032f5fd0b22a414ae527bc6f199e91d9

  • SHA256

    ac1419ee574abfa919bfed5e3043b1ee45e8e158738dcc73bf3d9c8f6c883802

  • SHA512

    8812877f09d026b4cc1f3f3b00d3426d03ad1ea18565bdd7ad9b9b48780c5a572fa82aefcd5a2cb0640fb5f8a4fdf11d88a9628240ae16b2c39e43a5a451a66f

  • SSDEEP

    24576:Ub4m+sws1qLVNMIlJl6DRKbAlcNRfCK9UfMxVVtes12FxwojKr98YGeGG9iO:UZXOjt6DuAwCK9UkxVVChjHZQs

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2