Extracted

• • Target

    Undetections.exe

  • Size

    1.7MB

  • MD5

    3af8847a68f187e5425af04cfe48d1cf

  • SHA1

    51005458a440023c8537db8a72f19094b91837b4

  • SHA256

    d241425f895f1f32b3f619c33d9b95820a25feb7ded489d449f36ac3c96b9865

  • SHA512

    50917f9580eb47f0b01cc90d57d40dca9eacdf01e5a80089148aa11fdbca2585e4c5cbf046f95c806f0771d4c47b7cfe7e477141d5352a4f9e4bc47ec2002f5e

  • SSDEEP

    12288:5V6HFV6H/YUeD1zgrmoxdGxa1PI+QDXMZ6GQ6ov2m+UtbVkGDvAd1sYV:5UHFUH/+1UrmyWalINbQUv2gVbAdR

  Score

  10^/10

  vidarstealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2