Extracted

• • Target
    8322e07c26f7c6e100e5b2be34080db4.exe
  • Size 1.9MB
  • SHA256 4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea
  • MD5 8322e07c26f7c6e100e5b2be34080db4
  • SHA1 9e894362c1be77eae233fbe20d9be5b7e4d095b3
  • SHA512 95927b20dac7dcc917e65804ddd9bc981643b2d50c2a3c359f1a8056fa2d33cc99ce6bb1140c2b5f3e9ef198bc228a4e799483561132fa14eb71e1c025abe354
  • SSDEEP 49152:SxwfjEfKpxnL0IDkgRI2AdPLNz3rfDBFN1s0mL3X:sA9p9lhRb6F7LBFY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidar1760discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2