Extracted

• • Target

    e3617487e1b1b47f2fb532af4483c269108230307f02e9690c6ebc8ad037f6c1

  • Size

    617KB

  • MD5

    b84c50c2ceb9b56069c7380e608319de

  • SHA1

    ed35a4711f16abaf3f0d68223545c87a5482f30b

  • SHA256

    e3617487e1b1b47f2fb532af4483c269108230307f02e9690c6ebc8ad037f6c1

  • SHA512

    3bbebba957448e7f5a3a55dafd2ddfd503c507497b051b03db0af00bb986f63bd504e1575b7a653463e29f959664a3488198b0b83998f8d4a9564261b8e81d01

  • SSDEEP

    12288:6DOzqXUCAB/DDDDDDKggISBALtfL1fOvU9K+t4p/oPyBYjKJcflr7v:6DNXUtoDBALtf99b4rWagr7v

  Score

  10^/10

  vidar0b3bd69430b7d827b107ba2ed809207dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2