Extracted

• • Target

    njrtdhadawt.exe

  • Size

    943KB

  • MD5

    96e4917ea5d59eca7dd21ad7e7a03d07

  • SHA1

    28c721effb773fdd5cb2146457c10b081a9a4047

  • SHA256

    cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957

  • SHA512

    3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687

  • SSDEEP

    24576:ajfMVHefX7eO2FwYPMGNL/geFyNcTN+jv75TQn652VBuNyb2i:oEQreO8wRGJtF4ch+jvNm0Nyb2

  Score

  10^/10

  vidara21440e9f7223be06be5f5e2f94969c7credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2