Extracted

• • Target

    S0FTWARE.rar

  • Size

    20.8MB

  • MD5

    4709e1f3f01585669f161cf99d205821

  • SHA1

    a22f4c996fa010f9a576b3db44715bedd161ecce

  • SHA256

    0c2435e614c2e120089f41d53729ebadd94d9654a65a2ed74e6eb3805501baa7

  • SHA512

    6b0f80564a3f208cbca1d439931f3447203558a90be1f195c7ea4bd3df5b2b318efee278c8015f1807cb5c8d0be04d982babd38dcfc9cb1439bd9acbd60d6bd1

  • SSDEEP

    393216:nl936aC5ZR3bDKZkEWdiM9FxxaV9DpgHx7yHlu5ltqSXua87uKv4:H36a0BdiM9YV9Dpu7glu5lcSbY4

  Score

  10^/10

  vidardiscoveryexecutionstealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1