Extracted

Extracted

• • Target

    sample

  • Size

    3KB

  • MD5

    21c010cf4481df82d7e5e4a0b4260793

  • SHA1

    d2ae87b41aa4e951c3a3131ce7ebc8969948ed97

  • SHA256

    b6e7e1ddaceee8c401056c0bd2e552c3545f6906b7de4b62ab3a239e5b01dfa7

  • SHA512

    8f97b34ecda980b0a738d98a99a28ba6f6ceafe65ae97f41b0fc8561a919796e729429507a18e9fe0ef79feb6ee892afb29fc325615c920d72111f3649b3bf5f

  Score

  10^/10

  executionvidar00cb84c6bd4caac4bdfc1131beae4df7credential_accessdefense_evasiondiscoverystealerpersistencespyware

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4