General
-
Target
7eeaa1acd2bb4b5162923958339812e3e2c84f682891c8424b7818f6cf20d068
-
Size
175KB
-
Sample
230124-p8th5sbc48
-
MD5
5209fa94f42535853436dc1ba4c06595
-
SHA1
ba32b047b9d46f616b0d86724f55e91902bbc577
-
SHA256
7eeaa1acd2bb4b5162923958339812e3e2c84f682891c8424b7818f6cf20d068
-
SHA512
54b9207d344924e4ad2cc4c15405ba9754bf8203dbb841b16da17f5f1b4be4a89a17ad87b66164cf2bc82ec81dd1157e5453ce01e5d3a3c05194118f539d5afb
-
SSDEEP
3072:4BN2h0FcV9LsS5n5GlFbb4wOU/RyhilXQbWFFJwK0M:gc9LsS5oFX4wl5DgbWrJwK
Static task
static1
Malware Config
Extracted
vidar
2.2
237
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Targets
-
-
Target
7eeaa1acd2bb4b5162923958339812e3e2c84f682891c8424b7818f6cf20d068
-
Size
175KB
-
MD5
5209fa94f42535853436dc1ba4c06595
-
SHA1
ba32b047b9d46f616b0d86724f55e91902bbc577
-
SHA256
7eeaa1acd2bb4b5162923958339812e3e2c84f682891c8424b7818f6cf20d068
-
SHA512
54b9207d344924e4ad2cc4c15405ba9754bf8203dbb841b16da17f5f1b4be4a89a17ad87b66164cf2bc82ec81dd1157e5453ce01e5d3a3c05194118f539d5afb
-
SSDEEP
3072:4BN2h0FcV9LsS5n5GlFbb4wOU/RyhilXQbWFFJwK0M:gc9LsS5oFX4wl5DgbWrJwK
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-