Extracted

• • Target
    9243520e8665c620e93c10508bf2c223.exe
  • Size 640KB
  • SHA256 33c2ca1cc03550022c20d672a3d541cb1b1d2009458dd46493bdf950e9ddc411
  • MD5 9243520e8665c620e93c10508bf2c223
  • SHA1 e9d1f0a0b4e6d6e0c5e1510d426cc319fca5526c
  • SHA512 2684136ae58fbde8fd4bb504463c2be0a8cc80ce5d891a20b364ca8f3af3bd503417ee641cd7dfd9cc207138e2c89debfbabf28f9de4d24e3e2b238f9129e971
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar517discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2