Extracted

• • Target

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

  • Size

    416KB

  • MD5

    aa18968e6cfbdc382ada6a3ed2852085

  • SHA1

    4a41fa1a182916d5790aa2071106b3441d64468d

  • SHA256

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

  • SHA512

    8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

  • SSDEEP

    6144:2tSK7xCXvZt/cuPXL/G1a5i7VHUOepEXqZCbt+sEtDDTS:2tSKtavZLPrCa5YHUjpdQbIzS

  Score

  10^/10

  vidar5df88deb5dde677ba658b77ad5f60248discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1