General
-
Target
3a538ff926f6fe2aee5d740540ffd698debf137078f07c7988f532067c9e3145
-
Size
297KB
-
Sample
230111-gz3rfsaf39
-
MD5
233ccfa678f47672ab414861c4391744
-
SHA1
1a2a842a27e81c7ef7d49e1f4974f0ef660bce68
-
SHA256
3a538ff926f6fe2aee5d740540ffd698debf137078f07c7988f532067c9e3145
-
SHA512
a92f6408c56d55ece997917409494824e4efbb3ffab8a73cc3d38124a82b82efda6f4a13f23fc1058dcab94df6a5d58caab37afa6bb67298de28da4393d35d76
-
SSDEEP
6144:kAT4pNprFwaCvNTkp51fk00keC50IhyUZbT:kTp3CU5kDkeC5jP
Behavioral task
behavioral1
Sample
3a538ff926f6fe2aee5d740540ffd698debf137078f07c7988f532067c9e3145.exe
Resource
win7-20221111-en
Malware Config
Extracted
vidar
1.9
24
https://t.me/travelticketshop
https://steamcommunity.com/profiles/76561199469016299
-
profile_id
24
Targets
-
-
Target
3a538ff926f6fe2aee5d740540ffd698debf137078f07c7988f532067c9e3145
-
Size
297KB
-
MD5
233ccfa678f47672ab414861c4391744
-
SHA1
1a2a842a27e81c7ef7d49e1f4974f0ef660bce68
-
SHA256
3a538ff926f6fe2aee5d740540ffd698debf137078f07c7988f532067c9e3145
-
SHA512
a92f6408c56d55ece997917409494824e4efbb3ffab8a73cc3d38124a82b82efda6f4a13f23fc1058dcab94df6a5d58caab37afa6bb67298de28da4393d35d76
-
SSDEEP
6144:kAT4pNprFwaCvNTkp51fk00keC50IhyUZbT:kTp3CU5kDkeC5jP
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-