Extracted

• • Target

    #Uc800#Uc791#Uad8c #Uce68#Ud574#Uc5d0 #Ub300#Ud55c #Uc99d#Uac70 #Ubc0f #Uc790#Ub8cc - #Uc2a4#Ud0c0#Uc27d #Uc5d4#Ud130#Ud14c#Uc778#Uba3c#Ud2b8.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

  Score

  10^/10

  vidarda1105e7cee8ade4acd1a4dc0b47dbbecredential_accessdiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2

• • Target

    W2

  • Size

    36.1MB

  • MD5

    2711a1512a4b86f0745885506d603397

  • SHA1

    31d665fe7bca6509824ed12904af18494490e27a

  • SHA256

    418f7a063559b628c394b4d3d47148e1226697c55fe5d478706ef96d122a9961

  • SHA512

    ea465376e333c0c4a481d9937256bc70051bdba5786a09798fec169cb281b01e566f04ab1fd2438462ca10e3dd5ee71c7b4fd8789661c31ed877ebc4dc4d9361

  • SSDEEP

    786432:94rbnl4Qbn+40bny4Rbn04ubng4dbnB4sbnn4rbnh4nbnH4a:94/l4G+4ay4d048g4pB4Cn4/h4bH4a

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    msimg32.dll

  • Size

    3.9MB

  • MD5

    5ffd78650614bc118ea029b086dffb3e

  • SHA1

    d552cfbc15052f609e23a9613866d5462a4318a3

  • SHA256

    c8bdff3366a5e82f090d54dee45a507c53caf619ab5285efccb0d5c69041b381

  • SHA512

    451f97fceb1127a37f064d86584ce0a81d47fcac3c4dd64eca3cf60a50437b29e1a6a7de5513f3dff72a96bfcf2a5f548751470b80c7ad34ada07fd0f43f864d

  • SSDEEP

    49152:Ptw8A/gVIBl8X3t6evYC/2NESehSE3TQaC+1RDYBylTTt4eri:xwA/SNVwSE30ajvI6TpE

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    저작권 침해에 대한 증거 및 자료 - 스타쉽 엔터테인먼트.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

  Score

  10^/10

  vidarda1105e7cee8ade4acd1a4dc0b47dbbecredential_accessdiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral7behavioral8