Extracted

• • Target
    7z.dll
  • Size 1.4MB
  • SHA256 15b10608affd4442d0e2ddb9b2fea847cd15d5405928d78ab73d81dae66db9e4
  • MD5 23a37370f275aa63255dfcc703951c37
  • SHA1 79e6cfa11747b633eb3d742d62dbed93a7b5f0d7
  • SHA512 98c917274b5bc9d005de4d53390bbecf1e685a42c6460db0503f36c27c4fba76048aae90064e78e81a1e6b9317a87d4e6f8e32317f63cc6f9c0704e8837dbe61
  • SSDEEP 12288:i/HBx5Byjg5f1t0dwQzZKZ03HGLIIdE4gtND+3PxAN2h6QoAhM0ZYN3cOqfnebcn:yBxB0dwvZ03HGLIqCWf3DeitpBQDtHh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Sfx_en.bin
  • Size 33KB
  • SHA256 d8f22e16a72e981b8c1d9978bdaefebfc2546d49c8f49f1ed3ede792f3812297
  • MD5 f16ba53292b1dbabe6dd6bf76a2b4f02
  • SHA1 dc23a0dc21eb7bb89b10eb7f8159ae9c989ba319
  • SHA512 a3ebcd4eec85481f5c70e4e83e01f225dbc6b7534247e4e34671367c2794048a70fadea0b42b64b680d5eb79dcbd72479cf9f15859e26f9f8002f7d09e4b1d43
  • SSDEEP 768:rr5NqrKII3Kn88aOQVY22qzzJWA87m7kf:xNqrKR6n88GGvYJgN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    WinNc.exe
  • Size 21.3MB
  • SHA256 34a31ce56c97fdc7a5db20c1dec741830c75d97b87c11c1658754419213ff6d7
  • MD5 167f5ba070706c4f1da96eba30c06c6d
  • SHA1 67b7034ab54a47da6c1b9dfb4268e1b4d24c2b8b
  • SHA512 840f30f1c4b6df8b430bbdc914b9f39647efa6b29c51c2aa7b0466e15cdf88d382aa0e9782299fb4ecec29b82b0c3be3c25d13c22702aa0fcb8892ce9ffa2075
  • SSDEEP 98304:caSXP8DYAoeoOmj/0I6qMizj14flA+IK7BJPcTt/229oduREUlIvPy:alAoeoOm0qhzj6ld7BFq/2i6uZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    unrar64.dll
  • Size 254KB
  • SHA256 bcf23a9441d6199cc13ef8bffea24f9d35f2d332fe90139a2297bcf174eba8e3
  • MD5 9eb37a35736b46369372a9cea8659333
  • SHA1 8d375593f171b88d27728322736d3c38acff6ac0
  • SHA512 88dd6bc1ce01c7ec5ae925083fff3e797eed9dc7b3f7f94f1202cbc7709de69ade5c7df82186228a9b44a670e6acb702eeb4b18402e7b9322d395cf59cd6b336
  • SSDEEP 6144:7dt+5JMTZJPnefq1bmm06DpA/2nODu0xgCgdnd:7dt4+VFyq19dk2ODKd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8