Extracted

• • Target

    8525216ca0f0f91a7d585e21ddf4de5b73706a485738ca72a1b2f583ab9d77b4

  • Size

    1.5MB

  • MD5

    693c1ff2dd4cb667bbb7568ca04fe6a2

  • SHA1

    f34b649c2e8718aa61d7fa4a7a541351eb1923f4

  • SHA256

    8525216ca0f0f91a7d585e21ddf4de5b73706a485738ca72a1b2f583ab9d77b4

  • SHA512

    9215fc8f08e68d9be6ff52e2633394dcfd9ede7dbf2544f1692143c6315818a39e55bc2f1bd8bd94f6585493bca01f8a0b687c1d2b64bd3bf5defa0e85b9f06f

  • SSDEEP

    24576:BXc46Crf8fyhacHps+/qASfmBgXk/xrADOv1xvF87uLwmnq:BXl8ahHHO+SASagXkJr4MDkUwm

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2