Extracted

• • Target

    d80007837ee60fe9537c76e6a3d45005a86ddc3e066e608b57e1d4430cb96df4.exe

  • Size

    1.0MB

  • MD5

    7723d62c8a6c95004f746afa54e8460b

  • SHA1

    01dff9bfe0bbb49ce51e611cbb9233d74ba1a596

  • SHA256

    d80007837ee60fe9537c76e6a3d45005a86ddc3e066e608b57e1d4430cb96df4

  • SHA512

    b55fef5246a4ada84a799e9e3ae6026ecc47566bf6150c3377d9dad743ff7f0c5a17759d0c1a121e4d530dae9ad60db0d21168d0180bcd63c6160f5927e84fcd

  • SSDEEP

    24576:s7wiALdYAa0xGv7L0TDQUjHA90zWy64aL/MxED:cIuAaoTkU0x1L5

  Score

  10^/10

  vidardiscoverystealeradwarepersistenceprivilege_escalation

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2