Extracted

Extracted

Extracted

• • Target

    7e87bb624ca8aebac6a71494ac7d190e1266ad509ce872c0cecf7695eccfe657

  • Size

    5.7MB

  • MD5

    9f9be61292c62089a46a872961cae046

  • SHA1

    093e4fa849ad041d3237eeba9c1de4dfc1446ffa

  • SHA256

    7e87bb624ca8aebac6a71494ac7d190e1266ad509ce872c0cecf7695eccfe657

  • SHA512

    8263e6a3f173a5339487637a1e2e6712602b7143e08034a37a2c73c9d191f7b9d423e1314627c016f4c905d47244f43d16959ab13aeae5a07ab8f08932c07227

  • SSDEEP

    98304:3wCLKnCmxzvm3VZ2NVPClN4QxjK5TBJ5Kw19sbQ0G3chMdKBC:bLKCm0GNhC8b5tHTjaMdd

  Score

  10^/10

  stealcvidar56561c66bf3314a2b5cad65677212bfestealerredlineriseprodiscoveryinfostealerspyware

  • Detect Vidar Stealer

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2