Extracted

• • Target

    16f358a2c51938127f5424b570ac3ee5

  • Size

    373KB

  • MD5

    16f358a2c51938127f5424b570ac3ee5

  • SHA1

    aeaa5233c747f386c19e1687a561f33de645e7c8

  • SHA256

    c2a0afb662be00866ddd7a7454e52b5f82252a837121371aa10dd2393d9b1c33

  • SHA512

    2413efbdbbccc8c4d28b128aeb88b02eb3844b39e3d46364d1a490fdead3a7d60a0a85c0f339b8feb68bbf75dfc86a2bcb71b632bcccb2cbe454e6523740f1a1

  Score

  10^/10

  vidar1163discoveryspywarestealersuricata

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    suricata

  • Vidar Stealer

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2