Extracted

• • Target
    8be0e006e72464ccafcad8fd1d3974d508d68b09ce7ce8695225bf52937c63c2
  • Size 1.5MB
  • SHA256 8be0e006e72464ccafcad8fd1d3974d508d68b09ce7ce8695225bf52937c63c2
  • MD5 70be32fe34bbf971615cea59e211bea5
  • SHA1 5d28c95c6f84387ea3fe7dc6a544dff9c1ae53f8
  • SHA512 a6f76140cd8b8b88830b5cb889ebd630c1d466ad0e7de08a0fc18fa830982a7b8a3f44c80ee59a9ed6d796046782dad284be584872adbf9a3e9abf0441a04211
  • SSDEEP 24576:BXc46Crf8fyAacHps+/qASfmBgXk/xrADOv1xvF87uLwmnq:BXl8aAHHO+SASagXkJr4MDkUwm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2