Extracted

• • Target

    setup.exe

  • Size

    472KB

  • MD5

    6052f8bcb046d6bff94a7c1166a9d6f5

  • SHA1

    ef38c207772abb3dd832390b60ca430e4f104a37

  • SHA256

    0d4ca324e676d8cd384902068b4caf199e1803fc82fdf3d7ee0fa7a902dcf4f1

  • SHA512

    ce45d5e807fb752a7769e1c9dbc489aa3ad352fa47a5d87e7634caf96a884e6246885ad587948f5a48df833c681b58cad3d42adf7a9c293a899b8ab85425e97e

  • SSDEEP

    12288:6EwlJEfdmBk0UIS6curQNyXIGtKkKghroaqpv:6PlY1IRrQNyXdtKkKghro9p

  Score

  10^/10

  vidare749025c61b2caca10aa829a9e1a65a1spywarestealerdiscoveryupx

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2