Extracted

• • Target

    f34b63635fcf1e5abe4738ac43b8c842c537c76ca0c4f726e867def5b690aa94

  • Size

    1019KB

  • MD5

    b9a838e6a3474a94b02aedb46c4af53f

  • SHA1

    577d3c948a526ea7b12a11cdf366bfbd23629477

  • SHA256

    f34b63635fcf1e5abe4738ac43b8c842c537c76ca0c4f726e867def5b690aa94

  • SHA512

    01232f0c549eedecddce3a773209bc06080b9d20faf5e7aa36359816e7d6c28a57a614a691f6ddf0248392a4be25c20404cfe55a0597bf37dd1889d221aea953

  • SSDEEP

    24576:5W8Ah4bCsXbgeFQp4dk8g7vSQceGBoI6BtKvKY7fw9aQsxg5kTkad:UkbCsXbgeFQp468DeQowr08GWg8

  Score

  10^/10

  vidar0b3bd69430b7d827b107ba2ed809207dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2