Extracted

• • Target

    1f65e4a559b6ca5bca255e34914d2a16.exe

  • Size

    1.2MB

  • MD5

    1f65e4a559b6ca5bca255e34914d2a16

  • SHA1

    35177abc3c3b2d8bde1e5fb5b91223d9f9a80d96

  • SHA256

    de49d99aca6f263329701def3789f4844cec7b66eada3ecdfc122d91a061beed

  • SHA512

    44c0560fd0fb995a07a4bda63bdc45184048c42038cd79a314949640353951862c511cdd8ff7f1b0c4c7bc1fce677124f9ef6c289893c0c534f65737aaf1cd8c

  • SSDEEP

    12288:aG3LBPOWjgduS18IFGL55r8eHwN6hKNCoJn1jZMPBP6IVmtQFLkw8tBKyp/DH2DS:hBry8IFQL8x8C1QOw8tBJtHaSlYITb26

  Score

  10^/10

  vidarae7206f995af44407705655c590dd082spywarestealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2