Extracted

• • Target

    file.exe

  • Size

    343KB

  • MD5

    ba97a8ba982684ffd26140b002fcf5f6

  • SHA1

    8d0b982e8e9aaf3a84e3b17ebc910d26d341b1f7

  • SHA256

    a3282df5188935d442674443e22d2f8bc5d5390a778b386a675d2a66a619d47b

  • SHA512

    27823fba4a49841df28e5cd99dc68d9a258213cafade5aacaabac60461bdc273751aba808c7008374b3c7861664c7b1b301556c9b2e5ada8bf6c435e05a5ea8f

  • SSDEEP

    6144:TuATLKIlDJxcqa8XJEex1reCZWzqJB+NFRzDghKQ2GxHDkk1c:TNWIlDJxcR8RZfU3AW8Ht1c

  Score

  10^/10

  vidar937discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2