Extracted

• • Target

    450f025a9a114a4e1b31986fa166633d9395a27189cfd64850d74ba0917ff846

  • Size

    771KB

  • MD5

    93fd664b208058a4b113fb52cd8fa640

  • SHA1

    8e85d3127654c99a2ae6ddc7b042e7ea1e4e481a

  • SHA256

    450f025a9a114a4e1b31986fa166633d9395a27189cfd64850d74ba0917ff846

  • SHA512

    a8759a87b506252fd402f12ba11791e1d0c01da9778823acd70e4587ee1b893dd33e09c1280111629845df8188761e26f9a1baa7cbbbab858b21e12af897c866

  Score

  10^/10

  vidar517discoverypersistencespywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1