Extracted

• • Target
    db6463b751ef817b9b5638571833cef10b72adfa7bf460fc2ba2448af3249496
  • Size 3.3MB
  • SHA256 db6463b751ef817b9b5638571833cef10b72adfa7bf460fc2ba2448af3249496
  • MD5 b904965e2232b8131769911f703b2e73
  • SHA1 f4a562cccb3047c6f61251495e5b4b6e314ba4ea
  • SHA512 719462d3a77a025adcf382df42dfd13de191baa9bd631a1b0a811130cbb0173523333a8e505c0d14b7b708dc529e2166f23b93ccf3c8e3856e4f986ac912b582
  • SSDEEP 49152:KYGq+q8ddKQW0cLI6rBoA0WAPiUG9dNpjYMIwsYJkp:K+Jyni7jYVws3
  • TLSH
    T192F57C07BD9108E5D09EA33188B7569A7B74BC580F3227E72E50B7782E727C05C7AB58
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ffdbbb25614ae3e540f1e3e55e6424a3vidarstealercredential_accessdiscoveryspyware

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2