Extracted

• • Target
    147c4f3da4b13ba13048e762128aeaf1270a9c9a47c7caf481feb947e4428794
  • Size 3.4MB
  • SHA256 147c4f3da4b13ba13048e762128aeaf1270a9c9a47c7caf481feb947e4428794
  • MD5 38d02de220bc3849fbc8632696f8dd6c
  • SHA1 4b02778c2e6387e73baa0b8404cf7346cd625695
  • SHA512 797dcc6f6cd3fa8a01f8bad5ed4133b9e72be420f3f56d30090d13e8267ebb9d3b4ce980dc8cd0e416d512af59ef98b7a1b123b3d7ea2da064a6921cc73a81cc
  • SSDEEP 49152:r6qhkQ1M83GoEYqVNzB0m8Uo/5iPKUBkNYKDfOnjAxcptYxItjY6IXs3NB:r0x10m85iCUBkNYefOjAxcpsIRBX
  • TLSH
    T11BF58C07BCA548E5C09AA73188B2655A7B74BC480F3627D72F60BA783F763E05D32B15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  c2c1e93079db92784253a5bfb2996544credential_accessdiscoveryvidarspywarestealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2