Extracted

• • Target

    4e20a0aa3d323c0a1aa676c7eb3656cdd34cb69da614b4dc8aa946f5bcb2be39

  • Size

    283KB

  • MD5

    84354d3c9965d9a0878596e347a34f39

  • SHA1

    f8e6d9f00d72f6f023e8d793462b7bb90cc31583

  • SHA256

    4e20a0aa3d323c0a1aa676c7eb3656cdd34cb69da614b4dc8aa946f5bcb2be39

  • SHA512

    2356ba4867985b609e1727f2a4877649f6c1b415d089dcef22c695baa42d3051cb6fb799eb7056ca75301a1aba47e71354e5051868f5bda04a62932a3ef72ad3

  • SSDEEP

    6144:S6JmCTAAGH0Jd9KZxnLlIak8/nPIO02s9F8oBNvAd9GzKeXOvEO:7mCTAAkY905yagO0D0OAH4KNEO

  Score

  10^/10

  vidardiscoverystealercredential_accessspyware

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2