Extracted

Extracted

• • Target

    7a95ae3b370d318bff008a07fddf1b6deb1beb78fa9e021c5c9f106d1149b553

  • Size

    401KB

  • MD5

    cb907b20ee4fb4389d25989d7de466e8

  • SHA1

    4d63141c71e834e81c5f57f90f663c409edf3a41

  • SHA256

    7a95ae3b370d318bff008a07fddf1b6deb1beb78fa9e021c5c9f106d1149b553

  • SHA512

    81c3f8e3362a565a426710b54e4f2b64165b764635818b788f43824b3f0cdd2dc354cbdb6ff945bdfe42bd4ade7ed05b721f978faa5af3d6df71cf6b81f13fe2

  • SSDEEP

    12288:jdI4y5LNCOuGcOq1H6Bvbw1tiNPUtIbsKRHo8:jq40NKaDiyPDI

  Score

  10^/10

  riseprostealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2