Extracted

• • Target

    Installer_pswd_12345.rar

  • Size

    23.9MB

  • MD5

    e8f8dfddd6c02017cc81f9d63c8f7ec3

  • SHA1

    bc536f36dbcc2c26b2cc8d00d5ed4a9620136c39

  • SHA256

    7e98e12c73ba2b3cc31c1d6b3b507e434b5a52fd85c9bcf190c684bd706e281a

  • SHA512

    8ae8fa85823744a19e9dcf7c7326abca219e25c95d009e1ae2cb0135f6568c05aa21baf16dad3771cd4d124771f498e2d351d9ba6d168f3b089d809f75ce146d

  • SSDEEP

    393216:w8HVqwk8k0hhbYjMd6Nm2uWpFmKwKpB6pHpuQv7erFJksa93F7nQJ6TdcLjIPN3i:bVc8k0UjxNm0CkBuJuQaJVulcoPhi5MA

  Score

  10^/10

  vidar8fc1cae2d848b9f26e1bb4d2655aff86stealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1