Extracted

• • Target

    handspecialisprot/handspecialisprot.exe

  • Size

    8.2MB

  • MD5

    e63f5a19c153dfe47509c7fc04055597

  • SHA1

    490946abad697b842820cdf34a3e728dad356f2a

  • SHA256

    7b7e1f0091db08d3b9508044e1861add62e956b614408e04e43843ccbe01d8fb

  • SHA512

    3db8f19b305b8658e80947631b9ff6f8810e8f9254f0687c73cf0e3505a4679da12cf59f94077aa1b6aa00606d2f5dad12c5f1545720fc4409709e5211da6779

  • SSDEEP

    196608:X+9fnWmR+m1aWLawiUQwrl767LoUu8Os4uWy92wAD1Ey:uJnWmRBaWmwPQwrliMUu8OsYy9bAD

  Score

  10^/10

  vidar1ad2efbf0ceace651c61a55794eeb149credential_accessdiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1