General
-
Target
Pas$w0rds_FiIe_1234_Du2_Active.rar
-
Size
4.2MB
-
Sample
221208-mlp64acf5z
-
MD5
26713ad375f6d34db5d150efa6cf366b
-
SHA1
11418f130237e237815e089a4634ac97ebbf8e99
-
SHA256
14c0e0ee6f7b71fa95d9503922349ea2268df30ff2763f18cbd4790261b6f43e
-
SHA512
fdceaf73f27165a2d6e85569997a7b627085bbed617b56877a206dd94fa55b78300381e53d483c925019390d2abf877f155571634b0609c704fd8ff3f9ebb400
-
SSDEEP
98304:mJnQP1rNr+WzWZgvMSP+RExlusJPpMJJ8YloUFKEiYrL3d:mG3r+WUg0SP+mSs/KJ8uRfbd
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
Malware Config
Extracted
vidar
56.1
1707
https://t.me/dishasta
https://steamcommunity.com/profiles/76561199441933804
-
profile_id
1707
Targets
-
-
Target
Setup.exe
-
Size
428.1MB
-
MD5
90b55fb63d500df098a3da8bdc4c07ba
-
SHA1
11fb1b9c094e79d4118151117077f45275b87d45
-
SHA256
845d709f5b400025a67cf4dc23822a6d50593bbeda5c302af1e7ba70b78a90bb
-
SHA512
a6464123d1deee98de9f38691587c05af1d4b577d92f894ed76512ecaf76a699ec9272fee6fba6e8167eb20d4bafb8b7132de2db695781b691cb1ad99ead5bc8
-
SSDEEP
49152:IWEIITzW5PeHRshUT8E8Lnjz2TN9W4bA9zOVUKrknrU+7i1VInD82OXJEPz:wINq3T8Ey+J9CaVDknrj7+VS8nXJQz
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-