Extracted

• • Target

    Setup.exe

  • Size

    750.4MB

  • MD5

    ecab43985219a0d403a57d68a7f031dc

  • SHA1

    557c2e853da449c241e4ac032d423e738a65057f

  • SHA256

    d1e1e02d213453eefdd80545b6a244e945ac5a6d38d95efa7c927deacfefd098

  • SHA512

    3857d46114db6707d03523ff17d4237b051d40145da2ce9c583d247a9450855e18a1946f52ce5c0519d9de56b7c7680befb916552b080866e08698b4ff44268b

  • SSDEEP

    12288:6XzzpXvdfXLhb4lfeMLRYOYDub54whqnhbam3FeHJK:cp/dfmJeMLRYY+2qnz1eH

  Score

  10^/10

  vidar812stealerspyware

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2