General
-
Target
PA$$w0rds_1234__FreeSetup4--M8.rar
-
Size
4.7MB
-
Sample
220707-q6747aahb2
-
MD5
f9d2e5c33d2d68ac65593210db8fabac
-
SHA1
03a8a6096cb58f7bbc7fb459fa2e7cadb703dcb4
-
SHA256
3a254bc1f6c0cd0730fad00a4b15510e919d9cc8baaef6292ad9c8d01c80453e
-
SHA512
76a5bb3349777bc80be9826ac6923744048f94afed293739cecdc3cb8cd26e7782000e0f0875872ad40ac84cbb4b84b0eee1ec1bdd9b460d3a51aacfcad5bb3f
Behavioral task
behavioral1
Sample
SetuperCrakeds1.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
53.1
1281
http://t.me/dvijkkkk
-
profile_id
1281
Targets
-
-
Target
SetuperCrakeds1.exe
-
Size
390.4MB
-
MD5
fe4db33ab22bc211a3e0e387e3d7580a
-
SHA1
5b7588911122de3add683d6920bc10388944a262
-
SHA256
d0c3e7a46e371b866fe189ebc8d30202cefebb558e278d04692eba4a65910605
-
SHA512
8a9ae201796474dd90dda00a39a9ce67c88cfc98ef22a1616e9799b0cce0d33b01612279cbd6bd463e7bdc7e92544e82d6d35ed39f3a5cb21ba31b2d49a7793f
-
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
-
Vidar Stealer
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-