General
-
Target
35c4f0759d7ea5dde09144afcdefbecbe3ec46438a0146bbf78d4c8b2e6589be
-
Size
3.3MB
-
Sample
220928-xpql5saaal
-
MD5
5bf4fe7b13b9cd51201ad7933023e600
-
SHA1
55decabb2797a81b5aa5c94e1ab7c22daf691d2e
-
SHA256
35c4f0759d7ea5dde09144afcdefbecbe3ec46438a0146bbf78d4c8b2e6589be
-
SHA512
7aed7eb0f34464bce967c1c3b17a0bf310043e8cf6cdcfeaa4aa435157e4aaea5d229da143470bebbdbea5250a5d4157a233a513729e68bd2fbb1870b69ac46e
-
SSDEEP
12288:6ktFjZXVSj646mcJ7Nj/F+IVAgQd15KkprI0gyaE:FtRZFSj6x7Jp/FrygAbpvXa
Static task
static1
Malware Config
Extracted
vidar
54.6
1680
https://t.me/huobiinside
https://mas.to/@kyriazhs1975
-
profile_id
1680
Targets
-
-
Target
35c4f0759d7ea5dde09144afcdefbecbe3ec46438a0146bbf78d4c8b2e6589be
-
Size
3.3MB
-
MD5
5bf4fe7b13b9cd51201ad7933023e600
-
SHA1
55decabb2797a81b5aa5c94e1ab7c22daf691d2e
-
SHA256
35c4f0759d7ea5dde09144afcdefbecbe3ec46438a0146bbf78d4c8b2e6589be
-
SHA512
7aed7eb0f34464bce967c1c3b17a0bf310043e8cf6cdcfeaa4aa435157e4aaea5d229da143470bebbdbea5250a5d4157a233a513729e68bd2fbb1870b69ac46e
-
SSDEEP
12288:6ktFjZXVSj646mcJ7Nj/F+IVAgQd15KkprI0gyaE:FtRZFSj6x7Jp/FrygAbpvXa
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-