General
-
Target
93c0d33bb0b95a0aef0735bf421d3442.exe
-
Size
641KB
-
Sample
210507-why5sr5se2
-
MD5
93c0d33bb0b95a0aef0735bf421d3442
-
SHA1
c04d24c4be5d86e1b47ab4ca0ce4c081f6389cdd
-
SHA256
1f904f9d59d9ee7f52c1d88d9c99fe9764081c8e575d2c6733960a514aac296d
-
SHA512
3b09e789b88daaffb3372c225bf23cc815a5b5738c52c218e3bfecd8f800e9c21027743786288cc72f8db1d0c391653044666fedf6902e72900f3c1e30b50020
Static task
static1
Behavioral task
behavioral1
Sample
93c0d33bb0b95a0aef0735bf421d3442.exe
Resource
win7v20210408
Malware Config
Extracted
vidar
38.7
890
https://HAL9THapi.faceit.comramilgame
-
profile_id
890
Targets
-
-
Target
93c0d33bb0b95a0aef0735bf421d3442.exe
-
Size
641KB
-
MD5
93c0d33bb0b95a0aef0735bf421d3442
-
SHA1
c04d24c4be5d86e1b47ab4ca0ce4c081f6389cdd
-
SHA256
1f904f9d59d9ee7f52c1d88d9c99fe9764081c8e575d2c6733960a514aac296d
-
SHA512
3b09e789b88daaffb3372c225bf23cc815a5b5738c52c218e3bfecd8f800e9c21027743786288cc72f8db1d0c391653044666fedf6902e72900f3c1e30b50020
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-