Extracted

• • Target

    c222e1c90ba989065e896c93031d5615.exe

  • Size

    340KB

  • MD5

    c222e1c90ba989065e896c93031d5615

  • SHA1

    c19fec40d2dd015edb50f2254e1107fbeb6ed5bf

  • SHA256

    d03a9053c011a1eae2c8b6561bdb60689330cd695c13fe0f614b35cb60060159

  • SHA512

    e64dfccfb886bc24842e036a2b2a34ff439af7799dc294a83a7b046d9e4c98074665bd95b0d1fea2f162abd2c50a16aec63a95a0c078f047be8cc2761ae1f6c6

  • SSDEEP

    6144:JH2ofI2u6ukzPZnu3eb+JZAZBefgAvVGVvu5fp4Dcl/OMeNfsEjiX:JH2of9uNKPZnu3eqJS+fg4QY5f2olReQ

  Score

  10^/10

  vidarir7amcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2