Extracted

• • Target

    50d415fba923077512d41e490dd33779946e324e271143c2975e5d45a1ab88c2

  • Size

    11.1MB

  • MD5

    831a24a8133f8a337d5fa89125ec1bc5

  • SHA1

    9479575f763772b527728c44fa98fc658882eb3b

  • SHA256

    50d415fba923077512d41e490dd33779946e324e271143c2975e5d45a1ab88c2

  • SHA512

    9cd0e1a94ad2867e4f51f5858aa466a31a724041ec0efc41dfa94619e1e545fab880e6f0833b440b242b5030a6d0732aed7a283ccca51cfe8c22c7477ec5c847

  • SSDEEP

    196608:OZbAM94MZrAo9GLcZFAN9/MvzQ8nAwYECnw8sqqA7M2D30y/9d5DX:

  Score

  10^/10

  vidar1148discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1