Overview

overview

10

Static

static

10

SetuperCrakeds1.exe

windows7_x64

10

SetuperCrakeds1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PA$$w0rds_1234__FreeSetup4--M8.rar

  • Size

    4.7MB

  • MD5

    f9d2e5c33d2d68ac65593210db8fabac

  • SHA1

    03a8a6096cb58f7bbc7fb459fa2e7cadb703dcb4

  • SHA256

    3a254bc1f6c0cd0730fad00a4b15510e919d9cc8baaef6292ad9c8d01c80453e

  • SHA512

    76a5bb3349777bc80be9826ac6923744048f94afed293739cecdc3cb8cd26e7782000e0f0875872ad40ac84cbb4b84b0eee1ec1bdd9b460d3a51aacfcad5bb3f

  • SSDEEP

    98304:RL5y3LHkWzDIhpDiVchYUyzi2mEMkSBOMrP3xuozfANPcDSpkLx:tg3LHVIhEV+SztMkSIMrP9p

Score
10/10
stealervmprotect1281vidar

Malware Config

Extracted

Family

vidar

Version

53.1

Botnet

1281

C2

http://t.me/dvijkkkk

Attributes
  • profile_id

    1281

Signatures

  • Vidar Stealer 1 IoCs
    stealer
  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Files

  • PA$$w0rds_1234__FreeSetup4--M8.rar
    .rar

    Password: 1234

  • Locals/fi.pak
  • Locals/fil.pak
  • Locals/fr.pak
  • Locals/hr.pak
  • Locals/hu.pak
  • Locals/id.pak
  • Locals/lt.pak
  • Locals/lv.pak
  • PA$$W0RDz == 1234.txt
  • SetuperCrakeds1.exe
    .exe windows x86

    Password: 1234

    f18f956555feb2b1bed6e59e26daf81b


    Code Sign

    Headers

    Imports

    Sections

  • langs/Arabic.ini
  • langs/Armenian.ini
  • langs/Belarusian.ini
  • langs/Bulgarian.ini
  • langs/Catalan.ini
  • langs/Croatian.ini
  • langs/Czech.ini
  • langs/Danish.ini
  • langs/Dutch.ini
  • langs/English.ini
  • langs/Farsi.ini
  • langs/Finnish.ini
  • langs/French.ini
  • langs/German.ini
  • langs/Greek.ini
  • langs/Hebrew.ini
  • langs/Hindi.ini
  • langs/Hungarian.ini
    .ps1
  • langs/Indonesian.ini
  • langs/Italian.ini
  • langs/Italian2.ini
  • langs/Japanese.ini
  • langs/Kazakh.ini
  • langs/Korean.ini
    .ps1
  • langs/Kurdish.ini
  • langs/Lithuanian.ini
  • langs/Norwegian.ini
  • langs/Polish.ini
  • langs/Portuguese.ini
  • langs/PortugueseBR.ini
  • langs/Romanian.ini
  • langs/Russian.ini
  • langs/Serbian.ini
  • langs/SimpChinese.ini
  • langs/Sinhala.ini
  • langs/Slovak.ini
  • langs/Slovenian.ini
  • langs/Spanish.ini
  • langs/Swedish.ini
  • langs/Tagalog.ini
  • langs/Thai.ini
  • langs/TradChinese.ini
  • langs/Turkish.ini
  • langs/Ukrainian.ini
  • langs/Uyghur.ini
  • langs/UyghurLatin.ini
  • langs/Uzbek.ini
  • langs/Vietnamese.ini