Extracted

• • Target

    7c34ee4fdc55e6fec4b6fe3d949942c6984be22f62bead05d46542612dd5a90d

  • Size

    2.2MB

  • MD5

    6dd0a57ddcbbe3d6854ca1c606fad134

  • SHA1

    b75f802eaa12d7aa1832c72f53db52c5b16ec7bc

  • SHA256

    7c34ee4fdc55e6fec4b6fe3d949942c6984be22f62bead05d46542612dd5a90d

  • SHA512

    a4e4ca5275f14789946bf195b7593f974f8e5c7f97574fcd9d7949a916c7f77635018764da167ced567bc9bf6001bd609de1c2327f030b0e572c32b5cdab566b

  • SSDEEP

    49152:lAgY7fvVtbBaxmcqMTBeufKQl+bH4JbjzzEBETT29YMST:llY7nTMBTBeufKQl+bYxzIBA6uMST

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2