Extracted

Extracted

Extracted

• • Target

    appFile_debump.exe.v

  • Size

    37.5MB

  • MD5

    6c3b270516a2731b1432f04cdefbb285

  • SHA1

    454081d69cf999c960cd03ebba0e38660738b8c5

  • SHA256

    9373f8ad1f33c0286734265cb5e60e69627fb5fd8f2220c655e6afa2d6ebda06

  • SHA512

    81ac6b5063d6927c01106b157e87f1f665c36bfc5dc8d24d1d8dc977d5d8918d07d3e9ed962d3b476f33be452c4d1cd68719f0ee35e712805ef141490a73cd3a

  • SSDEEP

    393216:ueXoa1bbXgKzn6vZrBoCMHUqbvkH/igbqmA8MLdculzFTi6AcsdNidnGF3rB:54CbwKzcHoDcH7qm6bTixca0ArB

  Score

  10^/10

  stealcvidar3a15237aa92dcd8ccca447211fb5fc2adefaultsavediscoveryevasionexecutionpersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2