Extracted

• • Target

    9ee64b8dc1af383e25ca542f9ede7a8b649c8b1477012c39fca179637fec289d.exe

  • Size

    4.0MB

  • MD5

    c8912fe8e08b4e0947b0c56201485581

  • SHA1

    2699d925e8a1708e86afac0f65d8e4797126fe90

  • SHA256

    9ee64b8dc1af383e25ca542f9ede7a8b649c8b1477012c39fca179637fec289d

  • SHA512

    c6eca8af85ceeec0a0221a067196bb17ed09bb00931371f79d262d53efcff405c38ea93bb9189d791eb3b358c121a9ec4475f754d1ea92045deff2de0426b70f

  • SSDEEP

    98304:wqjAMzqBA3pR8BG0Zu+wExyDfpvo0fc/jc/kA3:w4pzqCCBG05w1DRATct3

  Score

  10^/10

  vidar20f95c4f85151b21c48a8766fbd2d32dspywarestealervmprotectdiscovery

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2