Extracted

Extracted

• • Target
    𝗦𝗘𝗧𝗨𝗣.exe
  • Size 11.1MB
  • SHA256 9b3a153f1ea81fc5dfa96b78bd9b4f3d61f1171256cfff6a01a5da6b7b7b8e0f
  • MD5 42bff2077e89046472cd3b4fbfe304ef
  • SHA1 98f81da6caeebe2a778f35b3b2b4af37d86d5306
  • SHA512 8d59847e9674210cbf68def0fa70d7a99dcac6c71453b535baaa9b41a1f577a0ecb7ca457d0469a05302f847d154d0e92796c96fce8fcc3b64d3c1fbda47d9bb
  • SSDEEP 98304:ui/nlcOvqKP+GD5dQNLhjdRIFyiHDeFtety8oEvoJmY2XW6jBYekLOZgdRT8C:ui/nlCM+GMNrRIRUJ12X1tYj7
  • TLSH
    T1F7C67D7771A901E8D1BBD1BCCA4A9D07E772740643259BEF06E046662F67AF08E3E710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f35e8ab98a7693aa52ea2165196d5405credential_accessdiscoveryhijackloadervidarloaderspywarestealerupx

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4