Extracted

• • Target
    5f5a6a53fa0a869da21d3cce44be8b718f256ca7d68ca8dd8faf25e9fd9c7a44.bin
  • Size 4.1MB
  • SHA256 5f5a6a53fa0a869da21d3cce44be8b718f256ca7d68ca8dd8faf25e9fd9c7a44
  • MD5 da168c3ff95c749beec0a2f29a1e6b82
  • SHA1 8dc068b65b5ad95760d6f3cf58b4f7f9d8d21ed4
  • SHA512 23d019cae6b6d6087cf82318491743ad20b0bd6f5eb55a221b33b8e56f03f727f43e132e9400c75d3589ec734e0b9a8928e35c3fb0ffbebd754d8d3dbf93b587
  • SSDEEP 49152:xZvdUFoZPLIWG9fZmE1OOGa8NqtbFhuwosi3H5MEKjhUcQXeDSqFttjjEdKnwx6Y:xY5ZSitGJCVwiBovkk8v9xUV
  • TLSH
    T162167C07BEA14DB6C095A2328DA662823B79F84A1B3333D72D5073793E7A7D1AC75704
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  9883ed9357a3dd77b1d2b23683ea5450vidarnetworkstealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Detects references to legitimate web services potentially used as dead drop resolvers

    Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

    network

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2