Extracted

• • Target
    RedditVideoMakerBot_x64.exe
  • Size 131.8MB
  • SHA256 708e4c73217d10e821899bfb5296b72328520407f4cc38c4a525707568efa57d
  • MD5 33ec2af5e91cd5c71a3283d131aacb80
  • SHA1 a50ddbb0298800c408089f8f77c0f75b74ac0929
  • SHA512 3c1f21c123921d5d09aec763d7ff16bc94fadcaa6c590d679c26050e68de5e0e6c457d020493b666f05bc775ee508fdb2fdf5f51bcda33291d4612b77b531ce3
  • SSDEEP 1572864:7IQEyOLAs7B9ktxBpoYRS4XSJB4Gn0fXt8wrWhNExO5pSs97ORCaPX7qUecFVbuV:8yc3UxBiGS4XOl0fXtcPd5pJ9FLUFRu
  • TLSH
    T10468AF889D4A2F5BC89DEAF12E4D852520601D709D73F268F9110984EF7FF39E6187AC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  d5a46ee55854da7a10aa636753d7ad04defense_evasiondiscoveryexecutionvidarpersistenceprivilege_escalationstealer

  • Detects Vidar Stealer

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2