Extracted

• • Target

    theoryspecializedpro/theoryspecializedpro.exe

  • Size

    7.9MB

  • MD5

    680af4923dc7b8ce1c06516ce06d17d3

  • SHA1

    1487fcbdae76e1ebb5d55b9f76692959dd2cd5a6

  • SHA256

    6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6

  • SHA512

    e8b7cb2e6e791716159ed7906d3f0e0972a8a1b58a2ce46781adf5f45da3fdfc88b782153a3bde15719b25d489a2f12266d23f20a25b956e3dbf9ea7f95a67f0

  • SSDEEP

    196608:R6q51jd2HCwufvfbc7Mh7gOwQc5zlSJp0IV3DtBmS1aj9lF9q:RBd2HgfXbqMh7Ux5zgb0KRkS1YHj

  Score

  10^/10

  vidarcredential_accessdiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1