Extracted

• • Target
    d62c196235c2ff1b64e3ff73b72ebf01abda7bc0bbf247cdcb750c4ab8e917ba.exe
  • Size 383KB
  • SHA256 d62c196235c2ff1b64e3ff73b72ebf01abda7bc0bbf247cdcb750c4ab8e917ba
  • MD5 29d5025c7826e4c7fcdf4153a2b480d2
  • SHA1 81324e6846812811e961b46e362df0a467c8ea6f
  • SHA512 aab1623edaab9bcea8df19fa7070861d867e4aace528b7b7c34a4f24d4d2ca1af0658dab3b80009ee6e006179318a6473b681e44bfd21725fbfb6759d47853e2
  • SSDEEP 6144:XGO+83+N11n5au8LvOWjTMZG6wn+Y8ekx0wKYHMCsHW+S0ZaaPG:XGOv3+N11n5ALvpjTACn+jek0VYExdZa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidar543d9974ea5ff5192bbd07e6548921d7credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2