Extracted

• • Target
    Portals.exe
  • Size 149KB
  • SHA256 7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728
  • MD5 1f2c4ac075b7a79917c290f0b9fd27b6
  • SHA1 26b2d2ed94bea477e82f1dfe490aff259824ac5d
  • SHA512 4ada5989c043b25d7f97077e4ac6b47ecf3a1f7db69b9b6359990454146446f28f5b779354d97fad1bd2b5454538347e082a6e089cd4e5a0fc4e32f8ce8c0842
  • SSDEEP 3072:b3GqXhaXFCV70nVvzvgQMjTjm5qCxBfSIEt/4EIOxhy/fFqBO0A3UQ6oaJ:Jx6Fw70VvzgQMjTj0xB2ZnaFkgGJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidara32471de8323c66de43eb8313e806feadiscoverystealercredential_accessspyware

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2