Extracted

Extracted

Extracted

• • Target

    8a2b3b8e6b4b4dd888503f88003177f842b8601a43397a8abb5827e866ab2c70

  • Size

    4.7MB

  • MD5

    1570c3c8a9782660e2e96a584d620c68

  • SHA1

    4710a5198ddfb7a6af032ea783136b03bd7bea19

  • SHA256

    8a2b3b8e6b4b4dd888503f88003177f842b8601a43397a8abb5827e866ab2c70

  • SHA512

    e66186ae33d9858ca6bccb399c8dbba1d36f5799c5a11415dc163637987105bd9753eb703959dffc0319c713b56fc174182bf3e88de7137b34ec7cae8404de2f

  • SSDEEP

    49152:rwLX3Ex3SWH8pLzjJiqA4H4zu4vcCPXkyb9X4iPEAylTcUoFgZV0CX99:rwLXUx3H8dxirvHvbT8AocUoF0d

  Score

  10^/10

  redlinestealcvidarcac73a25dd295fef8853d330a75f6da4discoveryinfostealerspywarestealerrisepro

  • Detect Vidar Stealer

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2