Extracted

Extracted

• • Target

    AppInstaIIer.exe

  • Size

    34.7MB

  • MD5

    79e7fd3f75d702060da1bce9fffc1db2

  • SHA1

    308a13aa1d631fdf862c28184f5c4892a50427e4

  • SHA256

    c9c5581052462560bfe4587156b906c309ab10b19c5fe005a064384593609901

  • SHA512

    b6cda84590cf6ad44bb6e5a7750a886cc6a48395eb834f47144c6ee7b076b891154b68f5fea7d3c6b8cfb9521fcb494eddb2c6ca676f985be407c49f9857f32b

  • SSDEEP

    786432:G7dVMxn9bYyICJVmqPt0+nNICoie+MqNOym5v:GQnGBentbnd0/v

  Score

  10^/10

  systembcvidarhttps://t.me/jsvbdyufwibascqpersistencespywarestealertrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1