Extracted

Extracted

• • Target
    Setup.exe
  • Size 12.7MB
  • SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
  • MD5 bc1ca24e94b383cc9d341e4e3e88bae3
  • SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
  • SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
  • SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
  • TLSH
    T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  e4d12643d44b0f664cb095b3db1c2aa6credential_accessdiscoveryhijackloadervidarloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2