Extracted

• • Target

    1.exe

  • Size

    1.5MB

  • MD5

    efc2de49c53a388807ef989c2f6efa46

  • SHA1

    4ae5eeb4363c9f8b04bab4a1e40e4f057f74896c

  • SHA256

    1fed343aeac08b762cc565480913c8d0abfde1f3b18c79dc9e0a5133da903c46

  • SHA512

    3d4cdb9470c652edbf7b900f66b7885da903fe735d3fe08f7db6c7f082fe8c18630280dbb1b1476529135cb43ffd09b6247a798955e9e34456b3eb890c89f2b1

  • SSDEEP

    24576:dRrnyyHUF9Du6bbPJJ2sm5ChFzK8Pka0HEI1od8RbEYdmJl57BWBBkok4+i/Hjzw:dJvHku6iT5kK84Y8R7duWxk4+wHjzUBX

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2