Extracted

• • Target

    build.exe

  • Size

    119KB

  • MD5

    08388bb4894c71e7b1be4bad966c3824

  • SHA1

    7437ac98f08fc41283b900aa6fb0ae350d59dd6c

  • SHA256

    986a98dc33a925fa232e1e5311807c7681cad9e0f07957d81e4f2f8257503f9c

  • SHA512

    2adf5154e7dca7de1fcf12560c97f1b74e66fb3c5074d8fa9d29dd9da91a1314f9fc18270808c12364c4941a6a2346109824bd4c625df905f9be84af393934b3

  • SSDEEP

    3072:8Ho0VvS7fw67XojiwHjwlntccGGLz9VkYFP+WR9pLhbFnhSe2e2e2nw:41VvSM6ziiw0cMLzDj9VBne

  Score

  10^/10

  vidardiscoverystealeradwarepersistenceprivilege_escalation

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3