Extracted

• • Target

    90c4d8c8f396f66d9b556ab05344a8cd.exe

  • Size

    93KB

  • MD5

    90c4d8c8f396f66d9b556ab05344a8cd

  • SHA1

    4869f0a7a3a68f4638556e9df0eef34ea0fdc9d7

  • SHA256

    6ba3d50f87b4c2c81a8ab9247f2fafa6f4ec31d1f3acffbdb40a83ab351df9be

  • SHA512

    4d5a61a89f6e003b92f093385bd56f5d798ac73c1cc524b261a3ff704d251ef1cb450177404651b072feab954c94f617a88bdb55620920ac620c2c115d6b960f

  • SSDEEP

    1536:Irae78zjORCDGwfdCSog01313OQs5gcURDoq4OZZZLlCIibQwfclq8wJ:AahKyd2n31+Z5IRD68wbQbl4J

  Score

  10^/10

  vidar89433a6dbe159bb95b623839dcca3e27persistencespywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2