Extracted

• • Target

    e84f3f36aa22f8b7f7399ce57c68014ea23140e88755516db02b5e056d18dad6.exe

  • Size

    1.3MB

  • MD5

    13476835b5465cf91e4dd7e60e110e56

  • SHA1

    38af4e6440237a3f0f7eb8378a9f82ea473fc9a4

  • SHA256

    e84f3f36aa22f8b7f7399ce57c68014ea23140e88755516db02b5e056d18dad6

  • SHA512

    90635bef1cfd86608c757270f45658b9aacf582afa249a58b046f533c00925851dc9e6cbd04cf54b7ae55965cc25dd94eac90a7b78b7a4a6da32ad5bbc74f74b

  • SSDEEP

    24576:CMF7WKYDIOMJRvFadXXUfTwrlWB4Zsasxb3+PcRmJDh/:evDIOMJG9kil7bsxZIJDh/

  Score

  10^/10

  vidar744fd163d6d4e0ac37e4032bcbfbb6afcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2