Extracted

Extracted

• • Target
    3c7bdcf237822fd8387b038013f2b7d6354bb092341f29f58b9964bc6f7393ce
  • Size 2.1MB
  • SHA256 3c7bdcf237822fd8387b038013f2b7d6354bb092341f29f58b9964bc6f7393ce
  • MD5 588bc429c162baf29f714fcf16c5a268
  • SHA1 ee773390c88cf4ff18d167c8f417b1b7128711d7
  • SHA512 3763b8a8c1b5d718bbbe84c783e1211db830684f1786cfad6d158bf9e0fac220cbdd50350efc69e79d5b26e4baaa0ed41a28b1aeef782bd089be7a6062b81119
  • SSDEEP 24576:Ub4m+sws1qLVNMIlJl6DRKbAlcNRfCKhUfMxVVtes12FxwojKr98YGeGG9iO:UZXOjt6DuAwCKhUkxVVChjHZQs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2