Extracted

• • Target

    RisingStrip.exe

  • Size

    1.1MB

  • MD5

    754abb74ca81d5ac0338dc27c0419467

  • SHA1

    6b1266ea2b305178dc1b7bd17e4bf22c2ef6417e

  • SHA256

    ea8c2ccdcad3914c89165d94a5916986ee9ba4fbccce3563eaa5facba38cceb6

  • SHA512

    42eb7b838aa0b6009d5f5cf214797837b5876c6ce312ecebcf0864a5a82c85a71c854f0e4410c2aaa6d7fc147ed07584ae49011909290808e9d64dbfe3814cd2

  • SSDEEP

    24576:gmrT0o4MiMwK5w91RKUfX9F2sLwS6TJPTP/ACvFL0i+ZESls7emA:109MwK5+/KUP9F2MbirP/ACvFLSEPA

  Score

  10^/10

  vidarhu76fadiscoverystealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2