Extracted

• • Target

    b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42

  • Size

    594KB

  • MD5

    f275736a38a6b90825076e8d786ad5c5

  • SHA1

    c0d862ceab728736580f043316cdc099b2ab8924

  • SHA256

    b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42

  • SHA512

    b6662ee0426b45c5629808718613a687808deeaca692bb00d26ac5c9098b8a36a126ef80eca470db085aa5a84e38a9ee088a165cea821bf1226055a4fd842711

  • SSDEEP

    12288:Z23Df42FsPVesttHjpBKBmtvoYTjapYQIhtud8FpowFgXRo:Sz4xDTHt/tgYTjJQ0pXowWXR

  Score

  10^/10

  vidar2ee1445fc63bc20d0e7966867b13e0e1credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2