Extracted

Extracted

• • Target

    5756eb17961a1facf1f1c972dde0185932f10f7e7a6b3e756ac785418887eb26.exe

  • Size

    282KB

  • MD5

    5dd74b81e1e9f3ab155e1603a2fa793b

  • SHA1

    653cdaf8617c7fdec6f39db3334e858bec9a2d66

  • SHA256

    5756eb17961a1facf1f1c972dde0185932f10f7e7a6b3e756ac785418887eb26

  • SHA512

    9017f6797f998423e3cd88dcf1086f6e555797a9e6414ffd714dcb394cfd3f2b2fb5432c9ba38792021b5ba9e421454385f509c9363cedb7d3ac5919f66035fa

  • SSDEEP

    6144:kpKO3JjtQLCz0sVHReGoBtSTMv+ONYwjBv8ncRoHvYpUTl/KF//sEO:kvLVVBUt8Mv+ejBv8cGzTVKdsEO

  Score

  10^/10

  stealcvidardefaultcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2