Extracted

• • Target
    3035f7117b6e6a33f2f05d7c1d57e94a.exe
  • Size 681KB
  • SHA256 6537eb68c7eef05b0eadbcc46a7a948e96cea0ed538035ae17c2971c02e1329b
  • MD5 3035f7117b6e6a33f2f05d7c1d57e94a
  • SHA1 da2097ff5927e705efef06c25f371be30b6e3326
  • SHA512 f1cee42d366b66515eb46bcc5b09c903bbebc2ccd84f9e17d914a4dc47115c6cb6cbc744f23f98b73b8d4e1a2d62ec90becc00511767e14d204ae19b0a98ec44
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar890discoveryspywarestealer

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2