Extracted

• • Target

    a1e3bdcce3d07f6bc4015659a1a334413e619e39d89f5e8cf9304b7f44a93c36

  • Size

    303KB

  • MD5

    f2916222c3c59c2dc07859447acd4419

  • SHA1

    52f83a6127ac36108130a89057378dcfb3bfd91b

  • SHA256

    a1e3bdcce3d07f6bc4015659a1a334413e619e39d89f5e8cf9304b7f44a93c36

  • SHA512

    319facb7d2bfc14429c959c4443b4cafbae8200bcd2b9e866a7fb7f6de2a9c9dac70fd2c1a1bef3e908c80f5bcace28106dd8373b128e0c7891e59146320d857

  Score

  10^/10

  vidar517discoveryspywarestealersuricata

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata

  • Vidar Stealer

    stealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1