Extracted

• • Target

    c23243f0f0ed43f019f4c8b5d65830be64744600d90d21a2284fe5507d6a65c8

  • Size

    1.5MB

  • MD5

    2fa3cf09a49df469462f4a6b6631bb6e

  • SHA1

    155e52b6af8af33ac6c16df41860d93f81d47b8e

  • SHA256

    c23243f0f0ed43f019f4c8b5d65830be64744600d90d21a2284fe5507d6a65c8

  • SHA512

    66b873f77bbc6ab649f45de300d97ddebbe32afa0bcd463ef08270efd256fb2794155048ed7fd18c6ae88cd8b8e1837fc51fcaf2ae4d3796b1a79af1f5f7c557

  • SSDEEP

    24576:FQH4MilLLfPSJO0c3ErwoD/k9wokidQrlVSP0p+vMiZOVDtplF:m5KL30O00ONyw5iqpNUONtx

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2