General
-
Target
b506767afc283d98398a65d5571c55a473c7400b053b8cfcbec2c64c36f06869
-
Size
256KB
-
Sample
221025-2tgl9aebfl
-
MD5
ac7f17921f8bf9a7ea2c12f8e8b72520
-
SHA1
e4693df8ef7a39329fc6683fe32ed33496a8a2d7
-
SHA256
b506767afc283d98398a65d5571c55a473c7400b053b8cfcbec2c64c36f06869
-
SHA512
b085b5da0f3d8f1e4069d3790700ab3cb86900c3fb8d3978f63884eb2c3b057d00b1ecfe4e9f80bf55b31ab6d2113d0264356df82552953209f85f843cf21a99
-
SSDEEP
6144:86tLboGao4TjjGHprRwNzGTXnGobry+F0jET:8gfNao4TnGJrRtXnJPBFzT
Static task
static1
Malware Config
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Targets
-
-
Target
b506767afc283d98398a65d5571c55a473c7400b053b8cfcbec2c64c36f06869
-
Size
256KB
-
MD5
ac7f17921f8bf9a7ea2c12f8e8b72520
-
SHA1
e4693df8ef7a39329fc6683fe32ed33496a8a2d7
-
SHA256
b506767afc283d98398a65d5571c55a473c7400b053b8cfcbec2c64c36f06869
-
SHA512
b085b5da0f3d8f1e4069d3790700ab3cb86900c3fb8d3978f63884eb2c3b057d00b1ecfe4e9f80bf55b31ab6d2113d0264356df82552953209f85f843cf21a99
-
SSDEEP
6144:86tLboGao4TjjGHprRwNzGTXnGobry+F0jET:8gfNao4TnGJrRtXnJPBFzT
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-