Extracted

• • Target

    https://www.youtube.com/redirect?event=backstage_event&redir_token=QUFFLUhqbHIxbWNqZkpJT1hoMVhucnJrSXJZem9VU19RZ3xBQ3Jtc0ttUFZ4OUNEdEhaYnNpdkt5UVZ2SlJqaFlZSkRXWVZTbFBRMFZubWpLUWF6UUxHeHRUaDUyTmpfMmVPNlN5aDdJWEttcWRNWjd3ckRBaG56bjZxd3lST3E3TGJqd1pjaXJMLUNtUWx3Tlg3dWF3WjlHbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3is42kz6mwjhj%2FFiles

  Score

  10^/10

  stealcvidar635b5ceb8ed09951eb8d5e776815ad72discoverypersistenceprivilege_escalationstealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1