Extracted

• • Target
    6994051a1091c2a5a64fb4b330806320.exe
  • Size 1.9MB
  • SHA256 d1061d18dc4ceceeba9947137e84e68d689e7befb6f038b467a64c474d0c51d0
  • MD5 6994051a1091c2a5a64fb4b330806320
  • SHA1 1ed50b9022b2502d7b60efd795465a188df00901
  • SHA512 5290753ec42d13b885257fff4a85a7980bf3a782d27f2017548a6cfc974ad8cea4a0f0eb7ab5b7a0759c246c648099f79ff08cca001d4843b07b6faf3095d472
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar869discoveryspywarestealersuricata

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2