Extracted

• • Target

    Setuper_25.01.exe

  • Size

    67.7MB

  • MD5

    626f51544f775502a39adc747c31032c

  • SHA1

    b4b66766714ab53be82143ab81424b98a8cbac64

  • SHA256

    35d601f9d756bcc17a3b1311306eac3bf859c891feca5a218fdf220dcdc643ff

  • SHA512

    6871ee61a12d692bd535125cdb101f1b8265e7707083070e29c189c69cdccc238c8659deb3995e4245bd1000bf9995caa783443102ffd7bc2754d8c70f5313e0

  • SSDEEP

    393216:87eLd/nhouIETpkFh8KbodSLFBJbHRlLieEY9qIjAgOWT2ZR0HYaqz1T67bGjeBm:LLd/WbbMWlLi6TjD4FeBgriZApI/Bi

  Score

  10^/10

  discoveryexecutionvidarstealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2