Extracted

• • Target
    6344e03f4026603b9f263d9984d47c6d4e9b506a5d72eccb57d43b95e136eb0f
  • Size 2.2MB
  • SHA256 6344e03f4026603b9f263d9984d47c6d4e9b506a5d72eccb57d43b95e136eb0f
  • MD5 6d466dd0a56d082c96f711c6ee52601c
  • SHA1 75c84418d02eccc61d2a2ea507922ef9b9d994e2
  • SHA512 970010e7e9af9c52610b6a6c56bb6e5122d49aef670a31514b3312162d1554e57afac47419328c67cb4a9cdf3e9aed5c01f45778cb33b1c88b6b4ae4a5f1b63a
  • SSDEEP 49152:qpjNvr9ySAOmw4VHHO+SASagXkJr4MDkUwm:qpjNp7p4VHH8n5A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2