Extracted

• • Target
    Setup.rar
  • Size 16.3MB
  • SHA256 8ed46e64c67de2c2be65b90001ef44a754aec9c3228ce6569c728293f7f851aa
  • MD5 aad7ae9c7f4a4d4191cc8bc48e9fa978
  • SHA1 886ee8c8406950e279ee448594c1d2c92af7a265
  • SHA512 f453f5d798fae3e2eb3da0666c384a195d689a06952ec13d113c687b0e570f50911175fc4f115b3c22bc509214d74edf50601b7c59054cee4865de74d436aae7
  • SSDEEP 393216:N8zSZhTzOf260CLcHUa6xn9lp5vv/k44YU3mGny/GTCTaayg:N8zS7TzZdbHUf9D5vvtKlyGCTpl
  • TLSH
    T1E70733F496EB620DB88398842D87A4862892343DD6DC81FBE7341B5F1DF105B38BD993
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware4adf0689c53e323fa24342f3ae3cfdc7defense_evasiondiscoveryvidarpersistencespywarestealertrojan

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    defense_evasion

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1