General
-
Target
file
-
Size
418KB
-
Sample
221120-zfe56abb36
-
MD5
0350b4f8be3f0a87bdfb6d0d8461fd6d
-
SHA1
cda74c9eaae647f154fddfc60570eb3b70383f0e
-
SHA256
547d6668ee5c55f939521a78e8b9b94c72972c90ef3e30cc675d48629c580f8c
-
SHA512
056fd3e24a857e8958176e10994e6b787ea5bbcdf2d0905ebeb4e65e70edf5ac2338ae507494c975dc5d928bc9c0b1baa40c57aa6cfd6c12eb077372920b2909
-
SSDEEP
6144:XVjaA71pPMWVkj0/MBCXjU0Lxutik6ojsxDms6nkf8mCwb:ljaA71pPMQuBUfNIik6tN6c8Y
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
55.7
937
https://t.me/deadftx
https://www.ultimate-guitar.com/u/smbfupkuhrgc1
-
profile_id
937
Targets
-
-
Target
file
-
Size
418KB
-
MD5
0350b4f8be3f0a87bdfb6d0d8461fd6d
-
SHA1
cda74c9eaae647f154fddfc60570eb3b70383f0e
-
SHA256
547d6668ee5c55f939521a78e8b9b94c72972c90ef3e30cc675d48629c580f8c
-
SHA512
056fd3e24a857e8958176e10994e6b787ea5bbcdf2d0905ebeb4e65e70edf5ac2338ae507494c975dc5d928bc9c0b1baa40c57aa6cfd6c12eb077372920b2909
-
SSDEEP
6144:XVjaA71pPMWVkj0/MBCXjU0Lxutik6ojsxDms6nkf8mCwb:ljaA71pPMQuBUfNIik6tN6c8Y
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-