Extracted

• • Target

    99ef461bc750761a9fd872d354f234823ee68911ced1df1475a8c1d83c3df10c

  • Size

    2.2MB

  • MD5

    3e8ebeffaa6b46887d4e463a2860467b

  • SHA1

    e380e75fe571a48ab039ae7789689a6e54204803

  • SHA256

    99ef461bc750761a9fd872d354f234823ee68911ced1df1475a8c1d83c3df10c

  • SHA512

    4328848e16f8f6f4c2addae454540679d40adba34ad330be1f26ea9b94d5a0e8ae7022d99065d454aaee75c8eb2f599da0466b76817a30576c6165383cef2d96

  • SSDEEP

    49152:lAgY7fvVtbBaxmcqMTBeW0KQl+bH4JbjzzEBETT29YMST:llY7nTMBTBeW0KQl+bYxzIBA6uMST

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2