Extracted

• • Target

    Setup.exe

  • Size

    675.6MB

  • MD5

    acc3282f8baa586c256c7c1b6ff4522c

  • SHA1

    463d8ed383ad2a36a9df93dfefa493a2a95f4445

  • SHA256

    2d4a3b606626c54ef71e06abab01fb69a3ff26e8c7d5322c12511e5d8bd52dc4

  • SHA512

    e9e7321bde05e5e0f882bdd99695990dae509c24a168f017f8b83b332d350d8662e81bc380cae64730d9eeb6bccbd6a2c2a6a6aedace7a51483b4251a49ca2ed

  • SSDEEP

    196608:i0bq45mmYPrOLaxhWJVXdgvY23Jj/W5PCtLwFRpeZApj6bZy3yIhoR0LrLBsyyS3:bbq4o3jOLaSbKY2N/6CNyRp9j6bI

  Score

  10^/10

  stealcvidardiscoveryevasionspywarestealertrojan

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1