Extracted

Extracted

• • Target
    Setup.exe
  • Size 866KB
  • SHA256 929804f60f8f3a0b0d7862cd91eb6be0a2ba694c4a28e3f9fa2d65ff171469a6
  • MD5 4625f69b1be6f7d738a4df335c6ca306
  • SHA1 52125696d6846193d9e8275568ad0965d040c06a
  • SHA512 863bc0a02a4b94b64fa1a305f9d9ecf8bcacc961578430b922196b9fce30823a3a07442cf968176b0e291f5abc7170f9f9dab37e7988daeb99c4c9b1a7ad4ab7
  • SSDEEP 24576:Zg8AiKw1LbXu9Z5aHrS0tBF9doVhjY1fOm0w3Q6l6v3:ZgBW56T8BR2fU12EQnv3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2