Extracted

• • Target
    7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19.exe
  • Size 258KB
  • SHA256 7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f
  • MD5 b9212ded69fae1fa1fb5d6db46a9fb76
  • SHA1 58face4245646b1cd379ee49f03a701eab1642be
  • SHA512 09cab8ccedb9e53d6d2725e8b9dbbe8fa9552607a58d89876b6539a6612b2e7ac0440ef281971bec9191510915fa6264048510add493e6a862b0d3b4f006e342
  • SSDEEP 6144:YdAhH6pftFbsb8XODU4aLTwzLs0+mKnBtt:VUpftVcwIU4aLTwz5tItt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidar517discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2