Extracted

• • Target
    381ba69f104c2a1898b877237049c1de.exe
  • Size 757KB
  • SHA256 199b49aa0652bd1f91218124e488e3f65be1aac33a589626dcd0a24d5b3e56bb
  • MD5 381ba69f104c2a1898b877237049c1de
  • SHA1 e58d7bb856f957792458b1f61d116f3966e5bcfd
  • SHA512 294981e3711cafb5a7547024506b79eb581a6a4acd2e9dce727cb1eb5e706b94df03c795561efbecb929f5d9ca74458a2472333667bf3e4981783a9da9ad4111
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar1081discoveryspywarestealersuricata

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2