General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen3.24840.25430.18817.exe
-
Size
291KB
-
Sample
221205-2g4agsde49
-
MD5
8b2af24de5814668562cc1f27fd26ad0
-
SHA1
cbe6cf1f151ce5e7d24bd0f773a229a447b9a658
-
SHA256
b7bbac182f944d86b63f6a3ba9afe9c62a8195a8977c64802bea8042d6173186
-
SHA512
9643e8296fa7906882c29e03fd6808347bb12af04257e0a28e1bf9eb88de4a3efa3da0ab709322bbfc1577eebb7149d20bf420b2579834ccb75ceec8473c0f84
-
SSDEEP
6144:BIgiW1iFeUL95LRcUoSSwu5To90jz38UkxHCbXs1is+Yx/iRsUSGiV6GP:B4FZhcUoSSwu5To90UUkBCbXs1i7YxKN
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen3.24840.25430.18817.exe
Resource
win7-20221111-en
Malware Config
Extracted
vidar
56
1672
https://t.me/asifrazatg
https://steamcommunity.com/profiles/76561199439929669
-
profile_id
1672
Targets
-
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen3.24840.25430.18817.exe
-
Size
291KB
-
MD5
8b2af24de5814668562cc1f27fd26ad0
-
SHA1
cbe6cf1f151ce5e7d24bd0f773a229a447b9a658
-
SHA256
b7bbac182f944d86b63f6a3ba9afe9c62a8195a8977c64802bea8042d6173186
-
SHA512
9643e8296fa7906882c29e03fd6808347bb12af04257e0a28e1bf9eb88de4a3efa3da0ab709322bbfc1577eebb7149d20bf420b2579834ccb75ceec8473c0f84
-
SSDEEP
6144:BIgiW1iFeUL95LRcUoSSwu5To90jz38UkxHCbXs1is+Yx/iRsUSGiV6GP:B4FZhcUoSSwu5To90UUkBCbXs1i7YxKN
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-