Extracted

• • Target

    config.js

  • Size

    4KB

  • MD5

    b50f09dd1b24a4873bf0f24447ede431

  • SHA1

    4a32f009ae0f2988ccbe0994cd3e8720428891db

  • SHA256

    eb7593118f659dce4e1ef47eef2d465070c8cde955696f1f4925ff0076a54e3e

  • SHA512

    c99cb30f2f894ec9770638d3a0e662941bc5112c226ef0096fdd4b7ceda8541ba572602fa139c335db9cbf113937455170b73d04174cb8ef6674758f99876036

  • SSDEEP

    96:ZqF9oamAr0aIuSg42sEi6EkuzwQYwld9dyLh9gZsLvsFgl:ZqFyQr0jgjs9lhzw8OgiLegl

  Score

  10^/10

  executionvidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2