Extracted

• • Target

    Loader.rar

  • Size

    1.9MB

  • MD5

    62a2e8de31c7835c4273eb2c60fe4924

  • SHA1

    22e2f5a99974f9e5b1566245f5f712d2bcef396e

  • SHA256

    52f72f2ef4dd5e569025da115c891438565efa9aaa400f31e3a61313a9ce4243

  • SHA512

    52b84f8c0fdf9d31bb0b371333ff8b4a67faf76e8e42a57c512b6a8951260ab076374ffea7922b92fac0d2bd4bae95ffd1151a0ee1e7310c95ddf086ed31416c

  • SSDEEP

    49152:7D/0DZee/Yor/5YJ2g4NzW1KPD+S0foazh/LfGGVrkNwJJy:7D0H/YoL5YJ2g4NzWMSSaxGGVgNwJJy

  Score

  10^/10

  vidar24108ab9b5f23bbf924b5eff629e21b6spywarestealerupx

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2