Extracted

• • Target

    trigger.ps1

  • Size

    1021B

  • MD5

    6ef2f9449166c05acc12dbfcceaeb206

  • SHA1

    400ccd98d4cf1a1384421ce863aa1de9d7ae371c

  • SHA256

    33b832ed5ea4802a7dd24baf59f5b1380e2ce20b2739cca89b6f2f0e1c6f9da3

  • SHA512

    f843aaf898a8e3b59f61dd06f1b397c77a97417502f1a0a312a77568592ed397011dad1e95ec50f6c55099d352d02d472c91b701e2c8793c05a2d9f25a589b53

  Score

  10^/10

  executionvidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2