Extracted

• • Target
    55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77.exe
  • Size 271KB
  • SHA256 55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
  • MD5 8b8db4eaa6f5368eb5f64359c6197b43
  • SHA1 e9b51842e2d2f39fa06e466ae73af341ddffe1c8
  • SHA512 4da734da30af148f246f433b71c72677b9f78698424db15eba364233dff183cb998f9be13d2832872829ac545be1e15ff75ceb85fca3fd0784265fd576db0056
  • SSDEEP 6144:xfL+oq+hnjsVl3dRQTLU+2bRRR17+fYHPfIMDPSBJ7Y/B4aSi3V:xfL5njsVlNuc++Rj17+fYHPfIg4Y54ap
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vidar72f54d93118188013f2386eef7e5cc05stealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    ⠨/start.vbs
  • Size 231B
  • SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
  • MD5 abe1dd23ab4c11aae54f1898c780c0b5
  • SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
  • SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4
• • Target
    ⠨/temp.bat
  • Size 204KB
  • SHA256 e24aaddfa2ece0891ad7b3c51779c65bbf95e4fded59fc46fe4fef311e1de3e1
  • MD5 72b17467a49b7813856fa604d1d291c8
  • SHA1 3116d07854d56f0bc505be8b80804a7319208739
  • SHA512 38c99cc716097ee7cb642203432ffbd1ef6ce8a0c9b21aa2827962b82456ecb3113fa1edd362aab013737e3bdfb2d0803145fc0caf612054ba47f6454c3a4843
  • SSDEEP 3072:YZ5q1dIOxM7uywhXemKY2GDM676x3P6qpsIRRpAdJ6PjzqqaTehW6+Goun9Oem1Z:e+PLjkf7VGrrPrmKCeFIzxzwhFfyGWzC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6