Extracted

• • Target

    c4681d467c13250a60f1e082e5ac69ac4fc76c99e9a963a7cd40754aab1878d4N.exe

  • Size

    1.2MB

  • MD5

    c1229c9f62fb5dc205ca48f24064e7e5

  • SHA1

    2a8cf910b9107c3f6191360b2aad75e9cfad8d42

  • SHA256

    c7714d73edd1f58f4a4d513272a4db42164a8ae84a95fef04d6b15b6d652a449

  • SHA512

    5f5e8d4b25fd3b174dfac386d3174770e9d9c11e629fb6155e34d33f7acf3371aef53c9346baf2f7f17e79027acfe5d6fe43d2ed23299d43f15d336a94279514

  • SSDEEP

    24576:zvNbTWj0AZxq2aiBvSL/azDYDA+s62HwHgtxF1Fx8u0gaspEZqOBX4gH/e:ztydHFainl+srntxF1T8u0dspEZJBXLG

  Score

  10^/10

  vidar7971f50c9da61312610c634702ac07bccredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2