Extracted

Extracted

• • Target
    file.exe
  • Size 3.8MB
  • SHA256 9b83791bba1a2384a3f49d4c3abd96debfc2bced8a1fd7456810befd48b1dbfe
  • MD5 81e21774e6765d18444d02b58e68e598
  • SHA1 0ed5162adf4d59fe105ecc0122ab14912bd35ffc
  • SHA512 6bb7aa56f2fc3b357b633767cb3e9f40a647121bd60389dae02bd96f1347233667231a7575614b9df14c888dd3643ac7ffe964f00790bd370c3f89bf7c1264ea
  • SSDEEP 24576:rM/1oK5WuY4z61U9tNfTAW1MGucUyXwmGiWPrWKf9:rMdR5Tz61ItNMeMGa5xS6
  • TLSH
    T194168D5B7CD004BAD0AAA33288B261917B76F8191B3233D72F44B6783F767E06979714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  01ce16587cdedffe1810091f6cbbfbecvidarstealerbackdoorcollectiondiscoverysnappyclientpersistencespyware

  • Detects Vidar Stealer

    stealer

  • SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Snappyclient family

    snappyclient

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2