Extracted

• • Target

    SetupFileSoftware/SetupFileSoftware.exe

  • Size

    819.4MB

  • MD5

    6169c33081a2a4bc10b7919a78ca971d

  • SHA1

    94a1ece56ca2110a232cfd4092da62d7ba57a1da

  • SHA256

    9aef8fdc5e0b17b200a92382229795afeda78f01f8e9cd99fcad147d7bb146c3

  • SHA512

    9a55a46a928ab1157f162c80e8c1c648e36d1a1d5e8b4b69eb2907cda7ea1cd9c54395ac5bc95753eb9f294146dfb90940416154e9bc5db25b9305a95b601d07

  • SSDEEP

    196608:FF8LwftnNw5RQ1bXFdyTjdK3svnOIaUOrQ1bXFd6:FektN7NXfyAsvUUrNXf6

  Score

  10^/10

  vidar751spywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2