Extracted

• • Target

    TTDesktop18.exe

  • Size

    13KB

  • MD5

    22bded153b8c1ec4b1d1b45e0467f7c6

  • SHA1

    1c8825442a455da9ffa0fd56e0e2848dfa58bf2c

  • SHA256

    f07f39ca504a15d670eecad52c272ed5cdc4025fede61cd910d7da2a55d1d052

  • SHA512

    f6022cbf7120e1771e7ba992bcd59ba5f8f68507d91c10c997a3186766547ea0632347facfdec667c3bde261748eb93ee8df35c71600fd7c459539f629b408bb

  • SSDEEP

    192:0qgaiJUFTQcHVPtAXjJ9vT2O3yP8B50LOZdBcmCEJXVWwTnkVOvQu:57zFEcH769vT2OCkB50LknnVTnkVUQ

  Score

  10^/10

  discoveryexecutionstealcvidar41d35cbb974bc2d1287dcd4381b4a2a8stealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2