General
-
Target
784728d5862dcda82fbe844c241e6a3a.exe
-
Size
678KB
-
Sample
210509-6hpby9pgme
-
MD5
784728d5862dcda82fbe844c241e6a3a
-
SHA1
35c58dfd16cffdf3470ce2fc096abd9e9e5beadd
-
SHA256
b40ef2a1a14f793a9c57ec53a1e832b06858ecc1a37a161be80f3251266bcd26
-
SHA512
36183f73910062d66980420ad8e1be82a4025406aba6e0a9267d277258935ff58487217bf5cf428ef4adfa31e717bfc8b4bf1689cc786714a5736aa83c6c5c50
Static task
static1
Behavioral task
behavioral1
Sample
784728d5862dcda82fbe844c241e6a3a.exe
Resource
win7v20210410
Malware Config
Extracted
vidar
38.7
890
https://HAL9THapi.faceit.comramilgame
-
profile_id
890
Targets
-
-
Target
784728d5862dcda82fbe844c241e6a3a.exe
-
Size
678KB
-
MD5
784728d5862dcda82fbe844c241e6a3a
-
SHA1
35c58dfd16cffdf3470ce2fc096abd9e9e5beadd
-
SHA256
b40ef2a1a14f793a9c57ec53a1e832b06858ecc1a37a161be80f3251266bcd26
-
SHA512
36183f73910062d66980420ad8e1be82a4025406aba6e0a9267d277258935ff58487217bf5cf428ef4adfa31e717bfc8b4bf1689cc786714a5736aa83c6c5c50
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-