General
-
Target
file.exe
-
Size
3.2MB
-
Sample
221004-w8b3esbge9
-
MD5
81298a52170dd27d8afb431efa78e784
-
SHA1
1bad395207cc7769f321a6f6e8a7f149ec3bc34a
-
SHA256
e8075dd2f74391aabe1a85eeb7282620b5be0236d6d0a23e7474cf033dd1628a
-
SHA512
e1872c02d0029cb68230a3e34677adcb064d4c5f96e1e5ccbe667e5a7cb4e0b92207290154bf62736faa561c33a7b1ff8198fd23742e2bf305c6913050e7c1ea
-
SSDEEP
49152:v6Yz51eviu4apbZe5kyPQBUiuCynpwedGcZeZWN2Ejqs9rEwS0DgFypXk8JBo6Xd:v621Y4apNegX9cAM28qpwS0kq0b6Xzh
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
54.9
1679
https://t.me/larsenup
https://ioc.exchange/@zebra54
-
profile_id
1679
Targets
-
-
Target
file.exe
-
Size
3.2MB
-
MD5
81298a52170dd27d8afb431efa78e784
-
SHA1
1bad395207cc7769f321a6f6e8a7f149ec3bc34a
-
SHA256
e8075dd2f74391aabe1a85eeb7282620b5be0236d6d0a23e7474cf033dd1628a
-
SHA512
e1872c02d0029cb68230a3e34677adcb064d4c5f96e1e5ccbe667e5a7cb4e0b92207290154bf62736faa561c33a7b1ff8198fd23742e2bf305c6913050e7c1ea
-
SSDEEP
49152:v6Yz51eviu4apbZe5kyPQBUiuCynpwedGcZeZWN2Ejqs9rEwS0DgFypXk8JBo6Xd:v621Y4apNegX9cAM28qpwS0kq0b6Xzh
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-