Extracted

• • Target

    3d8c2fb9d4272ae0a835faa7715132ef

  • Size

    624KB

  • MD5

    3d8c2fb9d4272ae0a835faa7715132ef

  • SHA1

    b1a01340c98ec2c4654773c1a034897c16fa21c6

  • SHA256

    28b2ac088b804ab3e059a37134602c92f4f87010b650252f61cad73422827918

  • SHA512

    2a43afb5932c656e413b320f9750e48a37aec873a08998ebe734cc7f36a9fd524bf8bf2c6dd22712b4ed9157d0351557ec9929880e9b9bc50e402f0223a66d15

  • SSDEEP

    12288:G8CFnbfafLdd6BIKSj1Zih0LNCEhM+cqgN/JCWx8icDoIlxUKHTEO:zCRbyDWBGjTikoHw2/dx8iSoIlxUKzt

  Score

  10^/10

  vidar191375c1805c0d5109ea6297d63371b2credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2