General
-
Target
808a57d777d8d67a9acfa1834d19423a1f06d18086a458bb4c4a7dc28c3a650a
-
Size
254KB
-
Sample
221026-aj2qwseca7
-
MD5
579af8326f1e9408f65d45396ca08499
-
SHA1
6b6a46a352bf7ae63f4f76217bc8b2b6e45a2870
-
SHA256
808a57d777d8d67a9acfa1834d19423a1f06d18086a458bb4c4a7dc28c3a650a
-
SHA512
f4fc32bdbd570b658ee55738718177fed0226009514fddd9430d0818f319c9929dc376d6ec87e92b1e3ac011a08b737cb82615fbe56b1e85d63173647dd99061
-
SSDEEP
3072:1gXVRrhtiyLmSLE6kYbTujR2HkFObg3aU1YPk2luxucyrngYneT:+TrbvLNZkYbT7Hk4bg3d6ufy7LeT
Static task
static1
Malware Config
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Targets
-
-
Target
808a57d777d8d67a9acfa1834d19423a1f06d18086a458bb4c4a7dc28c3a650a
-
Size
254KB
-
MD5
579af8326f1e9408f65d45396ca08499
-
SHA1
6b6a46a352bf7ae63f4f76217bc8b2b6e45a2870
-
SHA256
808a57d777d8d67a9acfa1834d19423a1f06d18086a458bb4c4a7dc28c3a650a
-
SHA512
f4fc32bdbd570b658ee55738718177fed0226009514fddd9430d0818f319c9929dc376d6ec87e92b1e3ac011a08b737cb82615fbe56b1e85d63173647dd99061
-
SSDEEP
3072:1gXVRrhtiyLmSLE6kYbTujR2HkFObg3aU1YPk2luxucyrngYneT:+TrbvLNZkYbT7Hk4bg3d6ufy7LeT
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-