Extracted

• • Target

    file.exe

  • Size

    902KB

  • MD5

    dc9e7af38966a331ed872c56bcb5bd79

  • SHA1

    969dd4ab6006f0470fab17b2803912082fa49283

  • SHA256

    19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228

  • SHA512

    7f40b79158cc6549fb271a7854a86ba6023820a799bb6e8d2917c328e6bc1d7ab8e2677e34805f3f575b49d70776d94f8be9bdcd6f0270021b6546389fad5dc8

  • SSDEEP

    24576:DtZzl//mVsahD3lmgMD8j2EhYf4Fp7pb6zY:5ZzBahD3M98j2EMOp

  Score

  10^/10

  vidar23024979f5954ed7b86ed774172eb62ediscoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2