Extracted

• • Target
    beada205d664fcb12f9e85dd84d4deef4d70621b301ffebd2054aa5ac8de3362
  • Size 2.4MB
  • SHA256 beada205d664fcb12f9e85dd84d4deef4d70621b301ffebd2054aa5ac8de3362
  • MD5 655b5b8b112615a8e277b77a61c87511
  • SHA1 d49eea0e593711250a079939a15bf01a52d8ce15
  • SHA512 d480b97b8d2273af2febab25836cbe2ead9096f6b8bb7cb1fa51d764ef04fa5bf1ef9c9e5f99bbc87f081da7197089be535a81e5e8d1dbad4891c6e43d25ae57
  • SSDEEP 49152:tKbowAYr/6e7IRoR1hYm1SBhGYlrojQt6XQoXvx:tfcyeI6R1GCElqe6Aop
  • TLSH
    T194C58C0B7CE148E6D0AAA33389B761927B71BC490F7263D72E50B2782F726E45D79344
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  3bc41b1aa7524456de3f85c8d329d639credential_accessdiscoveryvidarspywarestealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2