Extracted

• • Target

    SecuriteInfo.com.Variant.Lazy.174506.16237.25035.exe

  • Size

    382KB

  • MD5

    de5694d171d676112fcd0626b05f716b

  • SHA1

    23292b9b87f67f26635e2ff4e6ab53f8a3b1983f

  • SHA256

    47581e7daf7e92fa4de9fdff4e7b055ca5c80a34656823aa4034a02c39390bbc

  • SHA512

    320a21b3f6de29c4e224ee44f7407c1be8d172a4b3377c9b1b3912170b6f6ab867df44b6e03e3457d93651d290530bbb50ad5df3a9818f08bd16131c59a3c299

  • SSDEEP

    6144:Icx0joKH4VwxjIqLT6L6TYjFg7xKXe8dxt6k4N/DAYiAvrzjO4jgB+1H4brfibtp:Icx6YVwR1T6LdjcKXeWt6k4pWAvPjO4B

  Score

  10^/10

  vidar1438stealerdiscoveryspyware

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2