Extracted

Extracted

Extracted

• • Target

    1e5ae623d5d328e48149f954fb43d3a36cabe967e330abe3505e4a1d54fe12bf

  • Size

    2.4MB

  • MD5

    06b916a433ba1d50af4ce9d8c522c51a

  • SHA1

    2f91f7983f7ca59ad067244ed48bd474d14092d9

  • SHA256

    1e5ae623d5d328e48149f954fb43d3a36cabe967e330abe3505e4a1d54fe12bf

  • SHA512

    13f31163b2d824703f00459cd5590ac5e5dc80e48dd70445ac8bcfd110f275954586bb88d5060ec93be2356c8324ae50b987b3afe37b2446e73a6c371170c21b

  • SSDEEP

    49152:HeRZ2k0TAxG+id+hzNXbOYdk3SCeUxhHbSZ93N/:HuLkl/ZOZ9R

  Score

  10^/10

  redlineriseprostealcvidardiscoveryinfostealerspywarestealer

  • Detect Vidar Stealer

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2