Extracted

• • Target

    file.exe

  • Size

    640KB

  • MD5

    883f31e2b928f6d5a7123dcd84d696c6

  • SHA1

    d3077361c775db9741247331ab1f1586110dbe18

  • SHA256

    e779097dea4435849f4c626ecd943bbfed6c74dbf01d138613c8490708e87c62

  • SHA512

    bc89064739fa8cc0138785aa1cd4c95e2358b571b6e939fa6a09356ba4c3ccfe613068176662b1e1740c159c8c25e4b1fde1c21657e40062703cfea198dffba7

  • SSDEEP

    12288:iLAQrnTCvlXfUaks2peBR3zfftaoKxh5/2xeHJyJlrDF64fzBKGyEh4hoABv:vcSlXfUaks2peBRjfM5l2xaEbh64rBDs

  Score

  10^/10

  vidar98d0d34b4e35131252d3d615526218eadiscoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2