Extracted

• • Target
    Setup.exe
  • Size 20.0MB
  • SHA256 55ea0cdc82a63317919669d1dd016da57823f0ba814399a76de28c623e558011
  • MD5 0a9c0d9c0a930d6f6fcd2e168035c734
  • SHA1 5eb533533a1069232c8f7464e879eb115afa1fc6
  • SHA512 5e1a275bab33c4e12960a789aa6f424c82e1b6fa9fd311acc7b1275953f5ce66f4499b4116a1a6e44870c4863befe809480a4838f29a9d660dda4bd7086a0e3c
  • SSDEEP 393216:CpbWAjdrRNgt5oE8cWvNZVTtB3YP/XHYL4VChH5ID4fI60aNw:CpiAxfUlCVz5B3iyMaNw
  • TLSH
    T146273338D28554FDE39252FA7349C2331A2CBC690975DE0F9FE1DB412E36F689A41A1C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  4adf0689c53e323fa24342f3ae3cfdc7defense_evasiondiscoveryvidarstealertrojan

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2