Extracted

• • Target

    Setup.exe

  • Size

    464.6MB

  • MD5

    350a2e8a8fd1cc46f25ff822b5fef864

  • SHA1

    6ced61594dbe240d0dbaa548eba526790b6e27f5

  • SHA256

    83b096c9efd0c9c855b9b8a7d70ebfb7f50e0449a824c52bf18a81b75a6037bd

  • SHA512

    27d75283812c73fe5e9d0bdfbf590ae00d2f2ae024c1dcc83c16e186ff65f2ceb3b939cef828e1bab7005356ba39d5dd96cca06a7d6fcfd37533aa48e68c2f15

  • SSDEEP

    24576:Lum9BtnqcmZV0mNzVLjFD23pWVKgnJC2Tld/wCyKkgJe/lgTbSUobuLA4ibic:L3qrZBLfY3pWVrJdf/wPKI/qRob2A4iH

  Score

  10^/10

  vidar839discoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3

• • Target

    resource/RedistList/Columm/whipsKnarredFilles/data.dll

  • Size

    213.8MB

  • MD5

    867bb097ceb506f01a8b782b121ca852

  • SHA1

    aefe4d3954cf2de0304ff8a1f5725e4a5ecc41c3

  • SHA256

    7d0d05dac12f27399dde7699bee3f85c00c7eebaddcfbfdce64533de4055e742

  • SHA512

    af8cfff829a0417e57215da86689ba892ba40ba8ee7b8f32b7b73fa132b63115d9d10365dd67e89e935316fdcdc06fcff2f0327cc27c434d850993d2365b3831

  • SSDEEP

    6291456:L8bSYBSkfXVSt7nsTR4dwl01X9b+6lYzPzv:oSY5NS5kmal01XR+6lYz7v

  Score

  1^/10
  behavioral4behavioral5behavioral6