Extracted

• • Target

    trigger.ps1

  • Size

    28B

  • MD5

    fbde43d916bb7ec62d1863fe3de8edbf

  • SHA1

    61787be021ab6e3e9f20f759da7b4e85747a7e22

  • SHA256

    f8b0d88d7094f254631363ddf906efc52ae7f71482c0c4041f07f7d069f89b43

  • SHA512

    05b22324b60a44f6b757f5a1df5566872ca08ef1b82e99947ba30415cc69454ef1927de0ff7b5e7927809d62bf89896c6a9ac9377bd4ad29971f4927fdd38421

  Score

  10^/10

  vidarcredential_accessdiscoveryexecutionspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2