General
-
Target
3403ded5e22e7138f5d7ab52ad1183d607a1072232c87668aad3c4e96c586e29
-
Size
175KB
-
Sample
230124-qyfpzade7z
-
MD5
211b0b04c2f56d909477c145aecee522
-
SHA1
8801e68d2c54e9f26df5a97d796ce75539e6fdeb
-
SHA256
3403ded5e22e7138f5d7ab52ad1183d607a1072232c87668aad3c4e96c586e29
-
SHA512
29a8231cfe76577b093970cef6f57dd417f30486c5f576fbd7db206e07cd519389339a9b0b24d315e3c840f1db50e8e17961de8c8a3c7d83c282e0f28bf8cd03
-
SSDEEP
3072:MBN2DctCL9kh0+5sSK6h4N6nFMALJ2pXceVJmLn:EIL9kh05pN6FMAopXcKJi
Static task
static1
Malware Config
Extracted
vidar
2.2
237
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Targets
-
-
Target
3403ded5e22e7138f5d7ab52ad1183d607a1072232c87668aad3c4e96c586e29
-
Size
175KB
-
MD5
211b0b04c2f56d909477c145aecee522
-
SHA1
8801e68d2c54e9f26df5a97d796ce75539e6fdeb
-
SHA256
3403ded5e22e7138f5d7ab52ad1183d607a1072232c87668aad3c4e96c586e29
-
SHA512
29a8231cfe76577b093970cef6f57dd417f30486c5f576fbd7db206e07cd519389339a9b0b24d315e3c840f1db50e8e17961de8c8a3c7d83c282e0f28bf8cd03
-
SSDEEP
3072:MBN2DctCL9kh0+5sSK6h4N6nFMALJ2pXceVJmLn:EIL9kh05pN6FMAopXcKJi
-
Detects Smokeloader packer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-