Extracted

• • Target

    tmp

  • Size

    423KB

  • MD5

    7fd2d4cf90f09e3c742766b2788e8a1f

  • SHA1

    707415c8ca9448193185c91ddeb54f32d43b41cb

  • SHA256

    73c1c8ae9461ae24e38f8ce58aa5d5837ddf773b46bfb43127f8417dac8034be

  • SHA512

    d01a88bfa3bb4d02f2af92d9639987a4e5c7f33868c3dc01225e8df07faa8763ad37a58854ad64cb56d224a75483126cb2d194cb6a691e5eae63aac3e2848d78

  • SSDEEP

    12288:SmLzrsyf07GVWWCNPLl3Muq++HFomaD2p:7Lzrz8K/CRLl8x+gFVp

  Score

  10^/10

  vidare100c2b9c85dc9adbd913bfc4846b201discoveryevasionpersistencespywarestealertrojan

  • UAC bypass

    evasiontrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2