Extracted

• • Target

    cdf54d084007ce041a0dd019ce47b8cf619b007e531460cbb8995cb5b7f15fa4.exe

  • Size

    13.5MB

  • MD5

    75097944c089d35d77e365650435f1e8

  • SHA1

    8b6544e94de86e2a950cea14dc5b965163dc39e4

  • SHA256

    cdf54d084007ce041a0dd019ce47b8cf619b007e531460cbb8995cb5b7f15fa4

  • SHA512

    cd5aec354118bbd247ae7f9276b0c809af738e736b7851c83e62dd483cab07f1bb78f5ab6f8390cff807d1e34d7ad64503914e8d5bd3915a48fb49d2050b2c3e

  • SSDEEP

    393216:6r03VX937lsi+GxpZd9TiCf35BUE85VmgK+FA:t3jjVJTiEBUEEK

  Score

  10^/10

  purelogstealerstealcvidarcredential_accessdiscoverypersistencestealer

  • Detect Vidar Stealer

    stealer

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1