Extracted

• • Target

    537067C176C5E36AE81938A38045B520

  • Size

    617KB

  • MD5

    537067c176c5e36ae81938a38045b520

  • SHA1

    e0666c4acb6df096639dd73e1de2bc6c83f6bb92

  • SHA256

    2bb01e5626c002242375d09553c52c5c009cb98525170cacca10c3cb72b779d0

  • SHA512

    1b1a22bec953d1dd50e7317ee97b7df62fff5c1bf2509d8ba3a0ac0b454d30265d3be0959c052634a8895207e9f466efce1d713123dccbddc6b232df7bbd9ac7

  • SSDEEP

    12288:xCh5qnPSABfUFgwm1EM9ThAtQ9s+yg5suVcU2bU7fFbJcslr7v:xCSnP9JU6jEAtPYgsEFGU7dtxr7v

  Score

  10^/10

  vidar0b3bd69430b7d827b107ba2ed809207dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1