Extracted

• • Target
    SecuriteInfo.com.Win64.Evo-gen.86445473.exe
  • Size 2.9MB
  • SHA256 6097d600120da31c7cfcaf07aff76c07a75a5c942d9c39489c1283e0c5604846
  • MD5 eeb577ef6f8df5b9db31fcec262596cf
  • SHA1 e5b6d8bdd54e98ba4248c34cb5162d2a4cddea12
  • SHA512 5a4258d191e4c338c3c0ef242acea641794439039faa263e4b4005e45c230e09c846fca43758304dd700a86233470911394cfccb475e245c45253d3294f14cb4
  • SSDEEP 49152:sx9jd0B1r5X1xv6oFIeUr/4y0uJQzCXKg/:s7SH6BL4y0slKi
  • TLSH
    T1D5D58C0B6C9008E9C4AA977289B651967B74FC194F7233C72E90B7782F72BD08D75B84
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  30e82a36fe6be8301f209eb26300f90ddiscoveryvidarspywarestealeradwarepersistence

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2