Extracted

• • Target

    b59a622278460eadede27acc282dc76ac00338efada5d144289dec7f3148dd36.exe

  • Size

    2.9MB

  • MD5

    9cf8e4753032fb7fa3f5da1b7613d005

  • SHA1

    bd23e0ef92c5b7b6d844b5c41e2f2536b9e9172d

  • SHA256

    b59a622278460eadede27acc282dc76ac00338efada5d144289dec7f3148dd36

  • SHA512

    7588369c6e3bf5006c000a2ca6afabf2fd31c6abaff673188e0e0b3c4e684ede1b836ef55a7d0cfc34518fa2002a6d650957d8f63e8df406555c3ad1fae83ad8

  • SSDEEP

    49152:RXy2gkTkvSaY0q8/df24onCU6qmS3W6bts/OYTDJVV9M+XcwDhC3Mlby:I2dTcSa+8/N2+1oBb6/rTD/PM9wDMb

  Score

  10^/10

  vidar932discoveryevasionstealertrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Vidar Stealer

    stealer

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2