Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
General
-
Target
Premium_FiIe_1234_Xc5_Active.rar
-
Size
5.8MB
-
MD5
f2aeee4074f83e4568829a38f562920a
-
SHA1
bb604d8edf3a5d1797309e06cb227dbda1ce3e85
-
SHA256
f82cf1d06e116945ecc0c995dd10c9e76e62ecbb9d7f0964d212822498d7c032
-
SHA512
bc6182cc3beafa316f7f20646688232d581df121fbba2c5bd25a7ba12197cac6c8e78f4e39f8ba89228a930f889f5875af37d2a6d3bc4630e4085c5030b64a96
-
SSDEEP
98304:qVU4/8aASNHgrt3T2nkseEySzUyGjjicbAZD0ACpm/Dn1kLjPeeh:UTS3vGUyGVbu0AC+kvey
Malware Config
Extracted
vidar
55.9
1839
https://t.me/headshotsonly
https://steamcommunity.com/profiles/76561199436777531
-
profile_id
1839
Signatures
-
Vidar family
Files
-
Premium_FiIe_1234_Xc5_Active.rar.rar
Password: 1234
-
X$etup-here .rar.rar
Password: 1234
-
About/ActiveXInstallService.admx
-
About/AddRemovePrograms.admx
-
About/AppCompat.admx
-
About/AppXRuntime.admx.xml
-
About/AppxPackageManager.admx
-
About/AttachmentManager.admx
-
About/AuditSettings.admx.xml
-
About/AutoPlay.admx
-
About/Biometrics.admx
-
About/Bits.admx
-
About/CEIPEnable.admx
-
About/COM.admx
-
About/CipherSuiteOrder.admx
-
About/Conf.admx
-
About/ControlPanel.admx
-
About/ControlPanelDisplay.admx
-
About/Cpls.admx
-
About/CredSsp.admx
-
About/CredUI.admx
-
About/CredentialProviders.admx
-
About/CtrlAltDel.admx
-
About/DCOM.admx
-
About/DFS.admx
-
About/DWM.admx
-
About/Desktop.admx
-
About/DeviceCompat.admx
-
About/DeviceInstallation.admx
-
About/DeviceSetup.admx
-
About/DigitalLocker.admx
-
About/DiskDiagnostic.admx
-
About/DiskNVCache.admx
-
About/DiskQuota.admx
-
About/DistributedLinkTracking.admx
-
About/DnsClient.admx
-
About/EAIME.admx
-
About/EarlyLaunchAM.admx
-
About/EdgeUI.admx
-
About/EncryptFilesonMove.admx
-
About/ErrorReporting.admx
-
About/EventForwarding.admx.xml
-
About/EventLog.admx
-
About/EventViewer.admx
-
About/Explorer.admx
-
About/ExternalBoot.admx.xml
-
About/FileHistory.admx
-
About/FileRecovery.admx
-
About/FileRevocation.admx
-
About/FileServerVSSProvider.admx
-
About/FileSys.admx.xml
-
About/Globalization.admx
-
About/GroupPolicy-Server.admx
-
About/GroupPolicy.admx
-
About/GroupPolicyPreferences.admx
-
About/Help.admx
-
About/HelpAndSupport.admx
-
About/ICM.admx
-
About/IIS.admx
-
About/InkWatson.admx
-
About/Kerberos.admx
-
About/LanmanServer.admx
-
About/LeakDiagnostic.admx
-
About/LinkLayerTopologyDiscovery.admx
-
About/LocationProviderAdm.admx
-
About/Logon.admx
-
About/MMC.admx
-
About/MMCSnapIns2.admx
-
About/MMCSnapins.admx
-
About/MSDT.admx
-
About/MSI.admx
-
About/MediaCenter.admx
-
About/MobilePCMobilityCenter.admx
-
About/MobilePCPresentationSettings.admx
-
About/Msi-FileRecovery.admx
-
About/NAPXPQec.admx
-
About/NCSI.admx
-
About/Netlogon.admx
-
About/NetworkConnections.admx
-
About/NetworkIsolation.admx
-
About/NetworkProjection.admx
-
About/OfflineFiles.admx
-
About/P2P-pnrp.admx
-
About/ParentalControls.admx
-
About/PeerToPeerCaching.admx
-
About/PenTraining.admx
-
About/PerformanceDiagnostics.admx
-
About/PerformancePerftrack.admx
-
About/Power.admx
-
About/PowerShellExecutionPolicy.admx
-
About/PreviousVersions.admx
-
About/Printing.admx
-
About/Printing2.admx
-
About/Programs.admx
-
About/PswdSync.admx
-
About/QOS.admx
-
About/RPC.admx
-
About/RacWmiProv.admx
-
About/Radar.admx
-
About/ReAgent.admx
-
About/Reliability.admx
-
About/RemoteAssistance.admx
-
About/RemovableStorage.admx
-
About/Scripts.admx
-
About/Securitycenter.admx
-
About/Sensors.admx
-
About/ServerManager.admx
-
About/Servicing.admx
-
About/SettingSync.admx
-
About/Setup.admx
-
About/SharedFolders.admx
-
About/Sharing.admx
-
About/Shell-CommandPrompt-RegEditTools.admx
-
About/ShellWelcomeCenter.admx
-
About/Sidebar.admx
-
About/SkyDrive.admx.xml
-
About/Smartcard.admx
-
About/Snis.admx
-
About/Snmp.admx
-
About/SoundRec.admx
-
About/StartMenu.admx
-
About/SystemRestore.admx
-
About/TPM.admx
-
About/TabletPCInputPanel.admx
-
About/TabletShell.admx
-
About/TaskScheduler.admx
-
About/Taskbar.admx
-
About/TerminalServer-Server.admx
-
About/TerminalServer.admx
-
About/Thumbnails.admx
-
About/TouchInput.admx
-
About/UserProfiles.admx
-
About/VolumeEncryption.admx
-
About/W32Time.admx
-
About/WCM.admx
-
About/WDI.admx
-
About/WPN.admx
-
About/WinCal.admx.xml
-
About/WinInit.admx
-
About/WinLogon.admx
-
About/Windows.admx
-
About/WindowsAnytimeUpgrade.admx
-
About/WindowsBackup.admx
-
About/WindowsColorSystem.admx
-
About/WindowsConnectNow.admx
-
About/WindowsDefender.admx
-
About/WindowsExplorer.admx
-
About/WindowsFileProtection.admx
-
About/WindowsFirewall.admx
-
About/WindowsMail.admx
-
About/WindowsMediaDRM.admx
-
About/WindowsMediaPlayer.admx
-
About/WindowsMessenger.admx
-
About/WindowsProducts.admx
-
About/WindowsRemoteManagement.admx
-
About/WindowsRemoteShell.admx
-
About/WindowsServer.admx
-
About/WindowsUpdate.admx
-
About/Winsrv.admx
-
About/WordWheel.admx
-
About/WorkFolders-Client.admx
-
About/WorkplaceJoin.admx.xml
-
About/en-USA/ActiveXInstallService.adml.xml
-
About/en-USA/AddRemovePrograms.adml.xml
-
About/en-USA/AppCompat.adml.xml
-
About/en-USA/AppXRuntime.adml.xml
-
About/en-USA/AppxPackageManager.adml.xml
-
About/en-USA/AttachmentManager.adml.xml
-
About/en-USA/AuditSettings.adml.xml
-
About/en-USA/AutoPlay.adml.xml
-
About/en-USA/Biometrics.adml.xml
-
About/en-USA/Bits.adml.xml
-
About/en-USA/CEIPEnable.adml.xml
-
About/en-USA/COM.adml.xml
-
About/en-USA/CipherSuiteOrder.adml.xml
-
About/en-USA/Conf.adml.xml
-
About/en-USA/ControlPanel.adml.xml
-
About/en-USA/ControlPanelDisplay.adml.xml
-
About/en-USA/Cpls.adml.xml
-
About/en-USA/CredSsp.adml.xml
-
About/en-USA/CredUI.adml.xml
-
About/en-USA/CredentialProviders.adml.xml
-
About/en-USA/CtrlAltDel.adml.xml
-
About/en-USA/DCOM.adml.xml
-
About/en-USA/DFS.adml.xml
-
About/en-USA/DWM.adml.xml
-
About/en-USA/Desktop.adml.xml
-
About/en-USA/DeviceCompat.adml.xml
-
About/en-USA/DeviceInstallation.adml.xml
-
About/en-USA/DeviceSetup.adml.xml
-
About/en-USA/DigitalLocker.adml.xml
-
About/en-USA/DiskDiagnostic.adml.xml
-
About/en-USA/DiskNVCache.adml.xml
-
About/en-USA/DiskQuota.adml.xml
-
About/en-USA/DistributedLinkTracking.adml.xml
-
About/en-USA/DnsClient.adml.xml
-
About/en-USA/EAIME.adml.xml
-
About/en-USA/EarlyLaunchAM.adml
-
About/en-USA/EdgeUI.adml.xml
-
About/en-USA/EncryptFilesonMove.adml.xml
-
About/en-USA/ErrorReporting.adml.xml
-
About/en-USA/EventForwarding.adml.xml
-
About/en-USA/EventLog.adml.xml
-
About/en-USA/EventViewer.adml.xml
-
About/en-USA/Explorer.adml.xml
-
About/en-USA/ExternalBoot.adml.xml
-
About/en-USA/FileHistory.adml.xml
-
About/en-USA/FileRecovery.adml.xml
-
About/en-USA/FileRevocation.adml.xml
-
About/en-USA/FileServerVSSProvider.adml.xml
-
About/en-USA/FileSys.adml.xml
-
About/en-USA/FolderRedirection.adml.xml
-
About/en-USA/FramePanes.adml.xml
-
About/en-USA/GameExplorer.adml.xml
-
About/en-USA/Globalization.adml.xml
-
About/en-USA/GroupPolicy-Server.adml.xml
-
About/en-USA/GroupPolicy.adml.xml
-
About/en-USA/GroupPolicyPreferences.adml.xml
-
About/en-USA/Help.adml.xml
-
About/en-USA/HelpAndSupport.adml.xml
-
About/en-USA/ICM.adml.xml
-
About/en-USA/IIS.adml.xml
-
About/en-USA/InetRes.adml.xml
-
About/en-USA/InkWatson.adml.xml
-
About/en-USA/KDC.adml.xml
-
About/en-USA/Kerberos.adml.xml
-
About/en-USA/LanmanServer.adml.xml
-
About/en-USA/LeakDiagnostic.adml.xml
-
About/en-USA/LinkLayerTopologyDiscovery.adml.xml
-
About/en-USA/LocationProviderAdm.adml.xml
-
About/en-USA/Logon.adml.xml
-
About/en-USA/MMC.adml.xml
-
About/en-USA/MMCSnapIns2.adml.xml
-
About/en-USA/MMCSnapins.adml.xml
-
About/en-USA/MSDT.adml.xml
-
About/en-USA/MSI.adml.xml
-
About/en-USA/MediaCenter.adml.xml
-
About/en-USA/MobilePCMobilityCenter.adml.xml
-
About/en-USA/MobilePCPresentationSettings.adml.xml
-
About/en-USA/Msi-FileRecovery.adml.xml
-
About/en-USA/NAPXPQec.adml.xml
-
About/en-USA/NCSI.adml.xml
-
About/en-USA/Netlogon.adml.xml
-
About/en-USA/NetworkConnections.adml.xml
-
About/en-USA/NetworkIsolation.adml
-
About/en-USA/NetworkProjection.adml.xml
-
About/en-USA/OfflineFiles.adml.xml
-
About/en-USA/P2P-pnrp.adml.xml
-
About/en-USA/ParentalControls.adml.xml
-
About/en-USA/PeerToPeerCaching.adml.xml
-
About/en-USA/PenTraining.adml.xml
-
About/en-USA/PerformanceDiagnostics.adml.xml
-
About/en-USA/PerformancePerftrack.adml.xml
-
About/en-USA/Power.adml.xml
-
About/en-USA/PowerShellExecutionPolicy.adml.xml
-
About/en-USA/PreviousVersions.adml.xml
-
About/en-USA/Printing.adml.xml
-
About/en-USA/Printing2.adml.xml
-
About/en-USA/Programs.adml.xml
-
About/en-USA/PswdSync.adml.xml
-
About/en-USA/QOS.adml.xml
-
About/en-USA/RPC.adml.xml
-
About/en-USA/RacWmiProv.adml.xml
-
About/en-USA/Radar.adml.xml
-
About/en-USA/ReAgent.adml.xml
-
About/en-USA/Reliability.adml.xml
-
About/en-USA/RemoteAssistance.adml.xml
-
About/en-USA/RemovableStorage.adml.xml
-
About/en-USA/Scripts.adml.xml
-
About/en-USA/Securitycenter.adml.xml
-
About/en-USA/Sensors.adml.xml
-
About/en-USA/ServerManager.adml.xml
-
About/en-USA/Servicing.adml.xml
-
About/en-USA/SettingSync.adml.xml
-
About/en-USA/Setup.adml.xml
-
About/en-USA/SharedFolders.adml.xml
-
About/en-USA/Sharing.adml.xml
-
About/en-USA/Shell-CommandPrompt-RegEditTools.adml.xml
-
About/en-USA/ShellWelcomeCenter.adml.xml
-
About/en-USA/Sidebar.adml.xml
-
About/en-USA/SkyDrive.adml.xml
-
About/en-USA/Smartcard.adml.xml
-
About/en-USA/Snis.adml.xml
-
About/en-USA/Snmp.adml.xml
-
About/en-USA/SoundRec.adml.xml
-
About/en-USA/StartMenu.adml.xml
-
About/en-USA/SystemRestore.adml.xml
-
About/en-USA/TPM.adml.xml
-
About/en-USA/TabletPCInputPanel.adml.xml
-
About/en-USA/TabletShell.adml.xml
-
About/en-USA/TaskScheduler.adml.xml
-
About/en-USA/Taskbar.adml.xml
-
About/en-USA/TerminalServer-Server.adml.xml
-
About/en-USA/TerminalServer.adml.xml
-
About/en-USA/Thumbnails.adml.xml
-
About/en-USA/TouchInput.adml.xml
-
About/en-USA/UserProfiles.adml.xml
-
About/en-USA/VolumeEncryption.adml.xml
-
About/en-USA/W32Time.adml.xml
-
About/en-USA/WCM.adml.xml
-
About/en-USA/WDI.adml.xml
-
About/en-USA/WPN.adml.xml
-
About/en-USA/WinCal.adml.xml
-
About/en-USA/WinInit.adml.xml
-
About/en-USA/WinLogon.adml.xml
-
About/en-USA/Windows.adml.xml
-
About/en-USA/WindowsAnytimeUpgrade.adml.xml
-
About/en-USA/WindowsBackup.adml.xml
-
About/en-USA/WindowsColorSystem.adml.xml
-
About/en-USA/WindowsConnectNow.adml.xml
-
About/en-USA/WindowsDefender.adml
-
About/en-USA/WindowsExplorer.adml.xml
-
About/en-USA/WindowsFileProtection.adml.xml
-
About/en-USA/WindowsFirewall.adml.xml
-
About/en-USA/WindowsMail.adml.xml
-
About/en-USA/WindowsMediaDRM.adml.xml
-
About/en-USA/WindowsMediaPlayer.adml.xml
-
About/en-USA/WindowsMessenger.adml.xml
-
About/en-USA/WindowsProducts.adml.xml
-
About/en-USA/WindowsRemoteManagement.adml.xml
-
About/en-USA/WindowsRemoteShell.adml.xml
-
About/en-USA/WindowsServer.adml.xml
-
About/en-USA/WindowsUpdate.adml.xml
-
About/en-USA/Winsrv.adml.xml
-
About/en-USA/WordWheel.adml.xml
-
About/en-USA/WorkFolders-Client.adml.xml
-
About/en-USA/WorkplaceJoin.adml.xml
-
About/en-USA/fthsvc.adml.xml
-
About/en-USA/hotspotauth.adml.xml
-
About/en-USA/iSCSI.adml.xml
-
About/en-USA/msched.adml.xml
-
About/en-USA/nca.adml
-
About/en-USA/pca.adml.xml
-
About/en-USA/sdiageng.adml.xml
-
About/en-USA/srm-fci.adml.xml
-
About/en-USA/tcpip.adml.xml
-
About/en-USA/wlansvc.adml.xml
-
About/en-USA/wwansvc.adml.xml
-
About/hotspotauth.admx
-
About/iSCSI.admx
-
About/inetres.admx.xml
-
About/kdc.admx
-
About/msched.admx.xml
-
About/nca.admx
-
About/pca.admx
-
About/sdiageng.admx
-
About/srm-fci.admx
-
About/tcpip.admx.xml
-
About/wlansvc.admx.xml
-
About/wwansvc.admx.xml
-
Setup.exe.exe windows x86
Password: 1234
d8c9c0350ce0254269505a253d4be7ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateDCA
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.phwrsm0 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.phwrsm1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.phwrsm2 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 350KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ