Extracted

• • Target

    Setup.exe

  • Size

    131KB

  • MD5

    2dfce881ad2ca0ca30c5ed6a92230b3f

  • SHA1

    c6792769d515fe768c4b81b123127cb0a08bd4ce

  • SHA256

    230d14997dbfa46128e59c5e2b54f542adb297b1b034f740078fb8d8c03d3df8

  • SHA512

    90c54deefd38e9c3c581bf504cc9db986526551690f983ff9d6a5caaa16d19d9d69143ab878a9cc95087851a26b537f3893f503b025d6024f4bcea58e18fc889

  • SSDEEP

    3072:uTOaWIM8/sjX/6jrvDmCIsqIAOb84vOyHAqbsmghhL:NIM80jXSfbqG8QOCbsphL

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3