Extracted

• • Target

    SecuriteInfo.com.Trojan.MSIL.DCRat.11088.10887.exe

  • Size

    234KB

  • MD5

    4851971e37ce8cd2b61a795780b7d4b5

  • SHA1

    eab1b044ddb4df43660b96cf8000e6b0bacf9f6e

  • SHA256

    6ca0732c155a15f67928a38c9c9ba8b2f08fb5e90fa38332b94b0457607c208b

  • SHA512

    82bbaa0f15206a2322a75d20571baf20c5e7e91c6cc5e1d4fdc1aebc36624c2da7cefa036e7bf6d1e0252a914e705631829cc12ade308f872ffe008b7c8731de

  • SSDEEP

    3072:Yiwwb6hYh8zBR4FGTy8YkMwjmalLUZ7d+a+4alnzr1AXwBdR+6dO6drF4OogCY14:dY+hxl6pi4lnzr8wBWr692c1IOq

  Score

  10^/10

  vidar028224d8754aad544d9c102ba2ac630cspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2