Extracted

Extracted

• • Target
    06d84544def57fc2a83943252cfc66f0e2446ebada33df42210efe55cc74e61f
  • Size 1.6MB
  • SHA256 06d84544def57fc2a83943252cfc66f0e2446ebada33df42210efe55cc74e61f
  • MD5 10b9c18a5328fd3c514b106508b5439c
  • SHA1 8260280cde2d578af80cfffb3b07c51fc5392d10
  • SHA512 0ad08ad01232290ac03b5b4497377500616802aa3a7cb7a70470c635ab76feecaa4f0132ef5a056fd1a03a51c0324554ba7b472e4eed631d6aa56cdf1ee9f27b
  • SSDEEP 24576:spM5863IGfTAVpalBiUfMxVVtes12FxwojKr98YGeGG9i:spQLYkTYp6BiUkxVVChjHZQs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2