Extracted

• • Target

    1b6a482264775b5ab5b792c89f4cb272

  • Size

    6.9MB

  • MD5

    1b6a482264775b5ab5b792c89f4cb272

  • SHA1

    c265d55a702cb0323f7347bea2915e8c63d89983

  • SHA256

    19415b0f141eba1d036f14bc99b970db90e5f29b2656f69a56980b19214994b2

  • SHA512

    5afaf1a5671962f752a28972d8b8fc348c1c1cc126d3ced48a0647eb37fb83d0910d7f4cacd31e17e9fb6a9dede8554be28fb48de275251440e30fe3b8a67113

  • SSDEEP

    196608:kPGZKb8Ehfrm4JYKtjADXsuIwDO+tkw06y2:VoJrzaKtjADVIUdR

  Score

  10^/10

  babadedavidar953crypterdiscoveryloaderstealerupx

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2