Extracted

• • Target

    207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342

  • Size

    4.4MB

  • MD5

    4a8099ca44ad78fa5414bab4f54ba030

  • SHA1

    ad1e9ee328d7eb870ebdaf9cf592a183f838f459

  • SHA256

    207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342

  • SHA512

    b1f905210d372c8352c07ea6c27bd71f12f7ee3a1e40375925bc6cb295b08d07d5bd9407e4da6e7d303a0951fb19e060a652951bfdf67f1151f19720e8698d03

  • SSDEEP

    49152:0fhvX07qcsIUv5z95W+diSQJAoCWFf4z6X5MS/tl3odglPCpgVS84OH:+hc7qcvWzE4OX53C+V5r

  Score

  10^/10

  stealcvidarstealerdiscoveryspyware

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2