Extracted

• • Target

    file.exe

  • Size

    2.2MB

  • MD5

    c06097200ce77e7d68dc2ca18b183096

  • SHA1

    378e60eee98c8407808c05561b144537d0b22731

  • SHA256

    36de150cba3d3477191cbe04958e9f887725df1e2e21a92cb18887620238dea2

  • SHA512

    022cc8ea990c987f95f1c50fbaaa4fd40568722574393183e17fe5bca8ab18f5b5ac44054b3708d616ff5b1065be0da1b6040024edc6ab610e5a908cb9eab2ec

  • SSDEEP

    49152:MqfnQVsS7590/aJKx0Wp8BKgZsj8oZ703EPaaX8nlRMAEL:MqfQjN90/eKuWp8WfZY3naXiMl

  Score

  10^/10

  vidar76b614a229b9a88f7d0ba57796ab0fc2evasionstealerthemidatrojanspyware

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2