Extracted

Extracted

• • Target

    stealer-campaigns.zip

  • Size

    11.8MB

  • MD5

    097972703f279cfccd4ddd533e972ca2

  • SHA1

    f064cb3f3ba19697a15e4a50e2d6c7253d03d27d

  • SHA256

    81866eb069ec59cdd5f41ddced9fab388962045ab1d67b2532985ff137da839c

  • SHA512

    3bba1bcb5d013a3464fed264c0703ff6ad12c71999f0cd2deb1ba6af6b64b56fb35bd35a5bc38135ee7cffc62624b7fbefc97b10e2f78ec052932a52da46cdb8

  • SSDEEP

    196608:dLlKS77IytThWWNl8BXFa5uwz2wR/E60NSBOvtoYIKNLj+LoA/nRWKrRu0vkHUOR:1YS77IIThK8E6KSSbIKN3nynRWKrRuJV

  Score

  10^/10

  stealcvidarevasionexecutionpersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1