Extracted

Extracted

Extracted

• • Target

    4f550eeca883fa772e5cec50c7c357591d8d24f892fa9ee416f2e780a3caf1b7.ps1

  • Size

    3KB

  • MD5

    b228c467b518134d8c53ff8612fb6446

  • SHA1

    c3eb9933f73851c7f7485813abb9711eabdb4949

  • SHA256

    4f550eeca883fa772e5cec50c7c357591d8d24f892fa9ee416f2e780a3caf1b7

  • SHA512

    21ae6179ae6df3f66268aba2762d882e47459034e790bceab17700fba4b65fa83e58d3cff86b68f146e2b8ea6cab34c8431ccc5763f0d740d4079f20522dcfab

  Score

  10^/10

  vidar00cb84c6bd4caac4bdfc1131beae4df7credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1