Extracted

• • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbk9UT25TQzQ3ZFFNeE9DR2wxN3NtUkVIbG41d3xBQ3Jtc0trNk04WnFqcDRIMFhzS3NRNmxDN2dzQXh6c2RudldxcUh5Qm9Pd3Z2alhTSnRZclBuSUlIdUtuS1BsRHVQeHNQX2dNLWRPSUI5TmZldklaWHhyZjl6T3VxUTBzVkZ2aDRURWZDSm5yVjRMaHE3ZGRuaw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3is42kz6mwjhj%2FFiles&v=qq0j1po9-D4

  Score

  10^/10

  vidarcredential_accessdiscoveryevasionphishingstealerthemida

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1