Extracted

• • Target

    SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

  • Size

    68KB

  • MD5

    5a4ccccb90b0aaa3b248d4f0dde38823

  • SHA1

    be8f1d791a81696cd58e7f837a97aaea58eeb26a

  • SHA256

    b802eb0f4a10d4aecc9015ee86ddc9b1249212dcabc2ecb6aa97418d0de7722b

  • SHA512

    a75db1a19a6bc4f5a9c5437864cb01e5d139ef56365e3d320035fcfa65a713886f78a6fe2f3eb130e35bed1a25e4fe73d712b6e03ed6bb373e73a6c3a3cb7737

  • SSDEEP

    1536:T7os4AvSdEcNj56sWOr3H8+wMiT8om0QSnouy8:TBvSdEcHWswxQJ0Zout

  Score

  10^/10

  vidaraf458cf23e4b27326a35871876cc63d9credential_accessdiscoveryspywarestealerupx

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2