Extracted

• • Target

    ce7c7b7a2699a304fcb6bad925f5ddf29fe00cb4ffe23593fe729b6e452dff7b

  • Size

    771KB

  • MD5

    248dd609e61ae13b52cbaebd8f92d07f

  • SHA1

    430b2b3812d6b08721c063f73559e609941cf85d

  • SHA256

    ce7c7b7a2699a304fcb6bad925f5ddf29fe00cb4ffe23593fe729b6e452dff7b

  • SHA512

    3adda33cc2a41f3123624437e87897b409526aecc821d0021056a65c881c3d224259a8e858172328076e89455b5a3cfa18bf6a4279490736f0a2141f75da21e9

  Score

  10^/10

  vidar517discoverypersistencespywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1