General
-
Target
bf41a296aebd630a2502acd8aaab7f2ca59c1f3536520b2a437e8cf1c5955f6f
-
Size
2.6MB
-
Sample
220215-hahknadbgq
-
MD5
529d889553b33611f0bbf08e4ac770b4
-
SHA1
8fb2a25d7aee18182d4e00b275f98e4bdc0c4bb8
-
SHA256
bf41a296aebd630a2502acd8aaab7f2ca59c1f3536520b2a437e8cf1c5955f6f
-
SHA512
0cbaa2003ffa60bf0a6cc9eaeef5ff68c702efd2f137df7f1671c87e260aa623c7f44a59b898946ea553bc594da37f94a3745998d1c4e1ce6793b5221c85b392
Static task
static1
Behavioral task
behavioral1
Sample
bf41a296aebd630a2502acd8aaab7f2ca59c1f3536520b2a437e8cf1c5955f6f.exe
Resource
win7-en-20211208
Malware Config
Extracted
vidar
48.1
932
https://koyu.space/@rspich
-
profile_id
932
Targets
-
-
Target
bf41a296aebd630a2502acd8aaab7f2ca59c1f3536520b2a437e8cf1c5955f6f
-
Size
2.6MB
-
MD5
529d889553b33611f0bbf08e4ac770b4
-
SHA1
8fb2a25d7aee18182d4e00b275f98e4bdc0c4bb8
-
SHA256
bf41a296aebd630a2502acd8aaab7f2ca59c1f3536520b2a437e8cf1c5955f6f
-
SHA512
0cbaa2003ffa60bf0a6cc9eaeef5ff68c702efd2f137df7f1671c87e260aa623c7f44a59b898946ea553bc594da37f94a3745998d1c4e1ce6793b5221c85b392
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Vidar Stealer
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-