Extracted

• • Target

    fc7a586cb68dab6be97d5a827af0e3c9e2377dff3df6952bbf0d93a204baa4cc

  • Size

    1019KB

  • MD5

    11ef1265ffdb39e9f3ab1980b3f63c39

  • SHA1

    a122d8a14960cd4c5e07730c8f737b48acb6827a

  • SHA256

    fc7a586cb68dab6be97d5a827af0e3c9e2377dff3df6952bbf0d93a204baa4cc

  • SHA512

    b05059a04f65d8e37e6911c5db490f33b60af726bfa0a3787abcf48975f88d8ef8884943277e8ea44c0da920bb22c6908cc820df195db2817fd6c2c2cf88b7c9

  • SSDEEP

    24576:yunAh4bu8PLo2tgRQd82g7vSQ82GRAeMB1K3K2dxASYBX3ELbyri2/Ss9e2:lvbu8PLo2tgRQS2D2gAQlH7YBHELbyr9

  Score

  10^/10

  vidar0b3bd69430b7d827b107ba2ed809207dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2