General
-
Target
aa653ae1e9e20219b399d64cb21449b45edda36e3c47d8eb071d678da85a9519
-
Size
223KB
-
Sample
221026-evwfgaegan
-
MD5
6f0233d6b96903a175395410e17553f1
-
SHA1
0f89c6c422329a7fee17b4123bf60fd0ec1cf41e
-
SHA256
aa653ae1e9e20219b399d64cb21449b45edda36e3c47d8eb071d678da85a9519
-
SHA512
17bbd65ab1e54dce3bd87d4a5c481682ee7a111cfd708814de29cec5855a77dbbf8f0c7ba5edbbcdc63f9b035f7d09cfd2a09719ec45b28b2fb13a66b8767ec9
-
SSDEEP
3072:kv/nL6LhsyAS73/JLheex6mM5waFoQdiVH4tPH4VyIbDWMqKp:kv/L4s273BLhzxtdQd6IIPJqK
Static task
static1
Malware Config
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Targets
-
-
Target
aa653ae1e9e20219b399d64cb21449b45edda36e3c47d8eb071d678da85a9519
-
Size
223KB
-
MD5
6f0233d6b96903a175395410e17553f1
-
SHA1
0f89c6c422329a7fee17b4123bf60fd0ec1cf41e
-
SHA256
aa653ae1e9e20219b399d64cb21449b45edda36e3c47d8eb071d678da85a9519
-
SHA512
17bbd65ab1e54dce3bd87d4a5c481682ee7a111cfd708814de29cec5855a77dbbf8f0c7ba5edbbcdc63f9b035f7d09cfd2a09719ec45b28b2fb13a66b8767ec9
-
SSDEEP
3072:kv/nL6LhsyAS73/JLheex6mM5waFoQdiVH4tPH4VyIbDWMqKp:kv/L4s273BLhzxtdQd6IIPJqK
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-