Extracted

Extracted

Extracted

• • Target

    884c8595250427c245264532b41f29334691e9b21b3526e9acb261a5952be10f.ps1

  • Size

    3KB

  • MD5

    eb268445cfc78545bacae46af1b5f268

  • SHA1

    82a4feb89a8f2240778e1d49b401e8d28fb0f718

  • SHA256

    884c8595250427c245264532b41f29334691e9b21b3526e9acb261a5952be10f

  • SHA512

    c19cfbe8e0b84ec9f84e6cf6153d253ae89bb868d775b21e69f5645ad16e4df9eeb4b4d039ba6bd050349448cccd811dc5e58e203cdcd43bbfea35c050274f8a

  Score

  10^/10

  executionvidar00cb84c6bd4caac4bdfc1131beae4df7credential_accessdefense_evasiondiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2