Extracted

• • Target
    test.ps1.ps1
  • Size 174B
  • SHA256 1bb7b314205b20d1dd7f616ab7d688a88901d055d85232ba12c475b41ef04efd
  • MD5 1cd78549ff4bfbc19670921e44ec29f4
  • SHA1 467b1a1c76993f2897a1dae918c0de2770c3926c
  • SHA512 f502a0a091db3cf95dfe2ea58065360dd43052f1512abf75bdf5d62615dcd8dd3ea41b1246066631c80e2178ce0f46748ce17a2139412ae99dd4caa8ef7efe37
  • TLSH
    T1F4C080A53477BF0C029017D554029DD0F2250AE0767F5FD4C7C14BAF45C5566B03D314
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  execution0c14910b9da47efb683982ba180cb5d2defense_evasiondiscoveryvidarpersistencestealerupx

  • Detects Vidar Stealer

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2