Extracted

• • Target

    1aaa52189ea936706d63c56f0357f7bb_JC.exe

  • Size

    349KB

  • MD5

    1aaa52189ea936706d63c56f0357f7bb

  • SHA1

    b96945fe789ec4e5039eec2f6f2ed20206843b7b

  • SHA256

    3cd9e155fca2eca60ed8a316efcebd2a45317ab4b957d0e8eef7470a104e845b

  • SHA512

    286d78256e12182f7a485032be9a260888a000ffb06cde18511150d993890ec6aceb2fccdd98fe8eaea9a64dd7dafd4f9d8a96265243448c0dc0cbd031fd9fd4

  • SSDEEP

    3072:q7FdzYZmtp5fNIwqus6kd4RDUAStYwUhTWCdcfNYgOx3Bpllhqb7E/XIOnjireyf:qrz7ZfNu6kdQoYwUtQNYJxrbqs/XQey

  Score

  10^/10

  vidarb2ced91faf30889899f34458f95b8e93discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2