Extracted

• • Target

    SetUpSoftwarePRO_v9.19.exe

  • Size

    782.5MB

  • MD5

    18c43f4a88e3a6c1a4f243407954d39a

  • SHA1

    593a9909a0c27f861926a95bf29f052bae7f7f0f

  • SHA256

    f50e031d2aa1551821cf2a6b06d9c4d07d55338f9e78add942793ef25501ec49

  • SHA512

    5119c7238c0d87776f7251724148efea76ff1b38d2b9871c3718fff27dc3d2ae672419ca120cb9ca1ebd5fe5eb658b65ac795d74d503772347af1c9acff40f2a

  • SSDEEP

    196608:Uth6DSxeWtalCT6FViTKWxdXbkRQVkqiewdqAv2:UtWsJ8lCT6Fo7BYyVkTewFO

  Score

  10^/10

  vidarf7893b40d11fea7da4c9eb28d53aaedediscoveryspywarestealervmprotect

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1