Extracted

• • Target
    e4e90e1dda4b51d199d449fa936db902.exe
  • Size 325KB
  • SHA256 8ecc0426ea37a5c9e59d00b4fde1508175a950372ec3870965f1e527634b3419
  • MD5 e4e90e1dda4b51d199d449fa936db902
  • SHA1 70de6b213f872ba782ba11cad5a5d1294ca9e741
  • SHA512 3958e1c40d69d5439b5e85bdb5765bb38ec5bba24f38a8aafb9a53c167ebaffb5c202441613af3f2d968c9c902de35036f67d87f7777efeb4c66869a7fc3c4ed
  • SSDEEP 6144:neleO4eULHur41zAVbWuOcSk5ZVymwi0HUS5XwnQHEfAP+O9l:neleOzU7us1qCu/5PF0HUSyC2/W
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidar517discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2