General
-
Target
75e3696c1fd8a5f7c9804fab344851e2.exe
-
Size
681KB
-
Sample
210507-nzdsn3eb8j
-
MD5
75e3696c1fd8a5f7c9804fab344851e2
-
SHA1
78dd58217626ed43b76b36eff4291010f865fd52
-
SHA256
1adf152f864e7da78406dfb915fa968b6a98f9bf4978ddbb41e84711cc64fcfe
-
SHA512
9a3e5fff40825361358f4ed1918b9c0dee575d86dc82fa47d8385a91a03862467a72cd84c3b9792cdd1cc6a5ecd086fd2fb6c2500a2b0f0cf36b744f65eefa0e
Static task
static1
Behavioral task
behavioral1
Sample
75e3696c1fd8a5f7c9804fab344851e2.exe
Resource
win7v20210410
Malware Config
Extracted
vidar
38.7
890
https://HAL9THapi.faceit.comramilgame
-
profile_id
890
Targets
-
-
Target
75e3696c1fd8a5f7c9804fab344851e2.exe
-
Size
681KB
-
MD5
75e3696c1fd8a5f7c9804fab344851e2
-
SHA1
78dd58217626ed43b76b36eff4291010f865fd52
-
SHA256
1adf152f864e7da78406dfb915fa968b6a98f9bf4978ddbb41e84711cc64fcfe
-
SHA512
9a3e5fff40825361358f4ed1918b9c0dee575d86dc82fa47d8385a91a03862467a72cd84c3b9792cdd1cc6a5ecd086fd2fb6c2500a2b0f0cf36b744f65eefa0e
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-