Extracted

• • Target

    076bdbac46ca40ee9712d5c74ebe561186e9b25d4b00df6ca8b2fdf62567677d

  • Size

    209KB

  • MD5

    5135ce446cdc96471bd70ce03ba7bfb5

  • SHA1

    0417f73790c731f6537673ffdb8d8c66fe47d2f3

  • SHA256

    076bdbac46ca40ee9712d5c74ebe561186e9b25d4b00df6ca8b2fdf62567677d

  • SHA512

    e8ee2c11fd104fa78705e7368f7abadd0b21f1a492c126cf1bc3528d4b5873031b759698480ed1794072007f24ffc34c9d02c2c8b8f7257aa84633962c8a60bd

  • SSDEEP

    3072:hElJQihVRcStC94yRnIqZsWWXaHC5v1XJ+MZ4CR/3ksVnSFxnOw69vD:hE4giiyRI66dXoC45uSqV

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2