Extracted

• • Target

    ac3999e4290648c6f63aee0e20e04be509b7c0aa74fb60f5e6dbcd083e3b7e4c

  • Size

    282KB

  • MD5

    c8a2d55c143d25ea7163ff04da854cd8

  • SHA1

    186940c774dd3e08195d6bab46c2b0170300a36d

  • SHA256

    ac3999e4290648c6f63aee0e20e04be509b7c0aa74fb60f5e6dbcd083e3b7e4c

  • SHA512

    7923cb651ac9d620e084f26a4666214cc22530603e4a8de9243df8b9e8c3466dfefdab80401ae52c0be5235510e07a0c176a4eb0f1440b77e48a6f10fbbcd799

  • SSDEEP

    6144:j1JhitNRsow2ECN3mxuJhe1gRjJ0WKBfTLia1bl9qRrEO:otTkFM3Ne1yyWKFLiSblwRrEO

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2