Extracted

• • Target

    66b5ace3a06b0_dozkey.exe

  • Size

    6.1MB

  • MD5

    1971d66193a4acc5be2af2c1d34c2d4d

  • SHA1

    e33f7bfb8aa73f1674e141590bfb823d0545312f

  • SHA256

    6ae1ebeb88e73be3fd5141deb9e85ed84203af1ef50cea7f2efc6be74816e52e

  • SHA512

    5e1d5b88035b183ac51dba94861bd95fc593c879cd6c5156b0e9e61c7af80aea8549ab623fa54ea7c33a60ce4843f7c0dfe9f834da00c7c885ee1bb7996416ed

  • SSDEEP

    98304:R5jFPIOFO/utnLvigHc5wqBg+HVkgq2KJ6l91N56OLyl:R5jNfnjPgBTBKM56yyl

  Score

  10^/10

  credential_accessdiscoveryspywarestealervidar

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2