General
-
Target
ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
-
Size
351KB
-
Sample
221203-tkj21shh9w
-
MD5
53b26d54fb8b4bbeb3412733b9b4eb8e
-
SHA1
fd3c0b834bc23328a1ba35e6550e0115d2fc11db
-
SHA256
ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
-
SHA512
b9cfa6af47830dda843bc4cc27ed6a96b7128374fdc332e151c0f85923517305973add59f71764826ca69f1637e7f150d4ea5e02b1158d324006d2f6b7b09830
-
SSDEEP
6144:7VXZAjepe90OPXTAx3CtnMW2RqnZDQtrY:7VpAjseqOPw3EMW3+FY
Static task
static1
Malware Config
Extracted
vidar
56
1148
https://t.me/asifrazatg
https://steamcommunity.com/profiles/76561199439929669
-
profile_id
1148
Targets
-
-
Target
ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
-
Size
351KB
-
MD5
53b26d54fb8b4bbeb3412733b9b4eb8e
-
SHA1
fd3c0b834bc23328a1ba35e6550e0115d2fc11db
-
SHA256
ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
-
SHA512
b9cfa6af47830dda843bc4cc27ed6a96b7128374fdc332e151c0f85923517305973add59f71764826ca69f1637e7f150d4ea5e02b1158d324006d2f6b7b09830
-
SSDEEP
6144:7VXZAjepe90OPXTAx3CtnMW2RqnZDQtrY:7VpAjseqOPw3EMW3+FY
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-