Extracted

• • Target

    d7bd6d21368392ddb23a0c2adca866c6.exe

  • Size

    4.4MB

  • MD5

    d7bd6d21368392ddb23a0c2adca866c6

  • SHA1

    1319d338785564d7586c7bf3a20bb4c86703b60c

  • SHA256

    74479202be7dde5fc60a3d3eb1c59625d57ff50ec00bfe0a39b8839829ae1c04

  • SHA512

    37ade21ea14dced6c51fe6bf21c588b87a584378d789ca44d5efca4f6e52d7d65f968135c78e4b80d96054c502e789e83624298d1281379f4aec82b57e9ad2ec

  • SSDEEP

    6144:JcYkhLaAOEDPGfHk//WZBj/LkZ+afxntlD/ogPtjQkjh6KQyCWCBs4wOFtNCjW:Jc2eifHk/eZJkZVfxt53hQkjiWCzKS

  Score

  10^/10

  vidar1636discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2