Extracted

• • Target

    05bae311bb96de87f65d0e3548d4c2ed.exe

  • Size

    7.5MB

  • MD5

    05bae311bb96de87f65d0e3548d4c2ed

  • SHA1

    31a99d3628f9e28e4905a7f6c15f4dd6c76c2244

  • SHA256

    3f92fd1cbc5200c8311a20e4a19b37e11fef32c23738c79a9e331f3d9ebbfb75

  • SHA512

    fb3bca90cc76dfc80ad8eaf446ddded735e6788317797a1c01de1a056c171cb51bf8fc41963f4699dcf0ffc9133d43e5f9efd01114b26925144266bc739610ec

  • SSDEEP

    196608:ewTq2Da99eBrjW+4YkvY5ENNfrxQcSjkpgz1tyOigbPcjQ68XGAaePpfj8uCPaF7:eUEFYRdK

  Score

  10^/10

  vidar1680stealerdiscoveryspyware

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2