Extracted

• • Target

    file.exe

  • Size

    359KB

  • MD5

    a1c33d360b68460d9b42d30ba8eb0b66

  • SHA1

    9a26e01b7330c77a2f15e39c0da564003841513a

  • SHA256

    1bd4abc21125d116ca1b721d180e1c36dd0bf7b78b69088a9b17c8445fdda085

  • SHA512

    47be7f5260bcaa860bfec3072d8a6db0c5c69cc9cc31f79c0f1fc44baa849bbb7f35c93066022f40f0c4694198105b33cbc218c38150dfbe02da4532b1099d71

  • SSDEEP

    6144:qb3pDH9HadMdX6jN2iVydIgckBqNEp+1w6PAgLcMvhlOO85kMC+vh7HMyx5g6VO:qlGMQg+yuaZMT4chlKqEp7HM25K

  Score

  10^/10

  vidar1718discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2