Extracted

Extracted

• • Target

    data-Setup.7z

  • Size

    116.3MB

  • MD5

    3152ed0815d3eb095c6e9c8469d99b77

  • SHA1

    addf193abcafc1d6099b787ae7be873c79b4f365

  • SHA256

    b99fa29a917eb26f7dd60427f9d4e261e95e06354e570b0e7f7c759672b9ebe7

  • SHA512

    b7eae4d1cd9c6c3edce37f2601e1f3528689d459c1780558a17ccaa770d189f6413f6b51105dac595d3afb9d95a28c24b7e5a7d0bdcdfd3cb1788fe672e918b4

  • SSDEEP

    3145728:+bjzx3kP0uuE0SWwn8lkUXljGeHS4RG9MGbVOKHntLCJCIXrd:Yz9kP0ut0Pwno1jGeySG9JVgJCIXrd

  Score

  10^/10

  vidarfc0stndiscoveryexecutionstealerupx

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1