Extracted

• • Target

    gig

  • Size

    334KB

  • MD5

    08ebe434574dbea9702086949683521e

  • SHA1

    38618aeb70a9305fddcf762ba59dfdd41bd09389

  • SHA256

    2893a6535330caac711d3f2d21538cd7107200cf422eec26eb982c1bd0425f39

  • SHA512

    a99268254a0e90323b25563819bd9f6e65508f8dd574a309608163cc5650aee7a31da8f68de6f20c2da4451f6b62e415de8ab34ae089e78ef222408bc1e65566

  • SSDEEP

    6144:0VYIbMos9I7CVYIbMos9I7YKFM98QFUoEO3zE8L29VYIbMos9I7uVYIbMos9I7:0VYIoos9I7CVYIoos9I7ZVYIoos9I7ud

  Score

  10^/10

  vidarcredential_accessdiscoveryexecutionspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1