Extracted

• • Target

    82ba99877892466b37e3944cc6dd84963daf0c4b992c98b439cc2bca2c0dccd0

  • Size

    2.2MB

  • MD5

    8d3d92973fa48e57d2e77373bbf133a3

  • SHA1

    15aa2669cd60081c680a6da40d5da4f3756454cd

  • SHA256

    82ba99877892466b37e3944cc6dd84963daf0c4b992c98b439cc2bca2c0dccd0

  • SHA512

    3d2725929e91a3c84c4b31bf35a4d850a02a2ee9b84e1f162e954c588a25d1e55ba77a707a5d5d425274d0cd9a129e542b1b333a07532173368008d8a4897531

  • SSDEEP

    49152:lAgY7fvVtbBaxmcqMTBeWiKQl+bH4JbjzzEBETT29YMST:llY7nTMBTBeWiKQl+bYxzIBA6uMST

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2