Extracted

• • Target
    66bde9ddd0fb80ac7309176c23d03804.exe
  • Size 611KB
  • SHA256 0a798e054fbe8545d4e1df781f3bb1a45b2fc58b5fb8d1c7383be8980aea829a
  • MD5 66bde9ddd0fb80ac7309176c23d03804
  • SHA1 45cd868973bac9c1808efdf19fd88dfd742cf7b4
  • SHA512 65089ca60de87ee1557ac907bfac2f14d02ef55d3d687c9fb4b0628dcb35f32ae9507c1eebb435f079a0b3ca19ea635a77ebc3dbc24ffc8032d23e291cc36b03
  • MD5 SHA1 SHA512

  Score

  10^/10

  vidar517discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2