Extracted

Extracted

Extracted

Extracted

• • Target

    x86_x64_setup.exe

  • Size

    2.5MB

  • MD5

    743e92349fa4e70b5d34bd9be733b41c

  • SHA1

    a1b82c3d1be61ba56e448a819990584df70a2fb4

  • SHA256

    486a9c9cdb67b95932d7e7deda2cdea44621c2b3f407f1206c1f3ce3766850ec

  • SHA512

    753a6314fcfa83302062e08d5704411234e321ff3eaf14ed92964576229491448e6960569c35c135fced32a80bdb65657343c08b8b1227d742377917052f0db5

  • SSDEEP

    49152:EgXyw1i3r1pIbtMja//3W6wNG3Ja0NDuYS5pwybSUZgBffTVSX:JXy3IbtMjalwy1N6YSnXZgB3Jq

  Score

  10^/10

  nullmixersmokeloadervidar933pub5aspackv2backdoordropperevasionstealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2