Extracted

Extracted

• • Target

    38d16dccfd335cf95f05ab43376b79a0f6f622a8252cc96b33c68fc5a263f8b8

  • Size

    2.1MB

  • MD5

    c49af08976d8324f556866373969b576

  • SHA1

    c4334b02493de064d9d26f5f482d24670bf7c343

  • SHA256

    38d16dccfd335cf95f05ab43376b79a0f6f622a8252cc96b33c68fc5a263f8b8

  • SHA512

    3d85e000b517e935023dbadb7e86f027e3e280c3b090eab9dea3159e0b38398f32a7bfb0e8a3a7329703b2adaf59b072920cced88a4262338a35473119cf86c2

  • SSDEEP

    24576:Ub4m+sws1qLVNMIlJl6DRKbAlcNRfCKFUfMxVVtes12FxwojKr98YGeGG9iO:UZXOjt6DuAwCKFUkxVVChjHZQs

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2