General
-
Target
file.exe
-
Size
5.0MB
-
Sample
221010-kybhcsbdgr
-
MD5
f31b3235d9c86fd1d8cd75d0cab28480
-
SHA1
6621cbf0016febb18b2194a3382bdc5989ec190b
-
SHA256
cf9ec473c74f0c8a122612aac898a544259bca56ed65cf13078671b192d2b18e
-
SHA512
9a4c4e9702f9d134a110206b2f8e1e893ca62e07ee82fbcebf1490be26f56b8538286f8bc46edb378236adef09ce6ccbfb7326af2b3c5f8a4f10c3e1948a70f1
-
SSDEEP
98304:OVj2YASI2ad3wNbgcEJD7/z2q9/0hEYB6nQaARrsMnsd+f:4iSFaZ68c0Cqh+P1I
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
54.9
1679
https://t.me/larsenup
https://ioc.exchange/@zebra54
-
profile_id
1679
Targets
-
-
Target
file.exe
-
Size
5.0MB
-
MD5
f31b3235d9c86fd1d8cd75d0cab28480
-
SHA1
6621cbf0016febb18b2194a3382bdc5989ec190b
-
SHA256
cf9ec473c74f0c8a122612aac898a544259bca56ed65cf13078671b192d2b18e
-
SHA512
9a4c4e9702f9d134a110206b2f8e1e893ca62e07ee82fbcebf1490be26f56b8538286f8bc46edb378236adef09ce6ccbfb7326af2b3c5f8a4f10c3e1948a70f1
-
SSDEEP
98304:OVj2YASI2ad3wNbgcEJD7/z2q9/0hEYB6nQaARrsMnsd+f:4iSFaZ68c0Cqh+P1I
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-