Extracted

• • Target

    ThoseFormer.exe

  • Size

    800.0MB

  • MD5

    f3d89e4861bb5cb5bc63ea7bd83804fb

  • SHA1

    dd90c95445b9d4653f367b1c7742ddd9cee49468

  • SHA256

    9af491589a55d702154a4851c0c7a0e8c5275798fdedf73ecbf2a516f0f3ffdc

  • SHA512

    c546217a4551d506e8fb78be43367a353c9911d9cc2b5a58fff2c89bd6f50670d69de4650e37c0eae57dbb18f84acff6a91cd4b605b11c5cb6c93fbf4516cda0

  • SSDEEP

    24576:N6FQppKd9CO9bjajGmd9XIvG3L9hqo3qXdFk7d8:MFem0OwjbdYBo3q4W

  Score

  10^/10

  vidardiscoverystealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2