Extracted

• • Target

    cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe

  • Size

    1.1MB

  • MD5

    9a30ee005b2b33436f0c5d6600507674

  • SHA1

    dae6301ecc10242b609e8b1d1d624772de14c28f

  • SHA256

    cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef

  • SHA512

    59b0ba792acdc46a61e07cddf7a3c3d051743433062432cfef0daba33ef9ff9b5be6f2e46324ee405132fc4d282cec62fc8b79471bc184392bd5d34e814b1162

  • SSDEEP

    24576:/9ZWDjMzibzyO/xkZawNwKrXsjGiYqbDxLOJDjt5r7L2rvqHq:/6DjY495kTwmXseqbD9OJXtFqvqK

  Score

  10^/10

  vidardc012f980711fe846b1fec1f4b705f4acredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2