General
-
Target
file.exe
-
Size
176KB
-
Sample
230124-t64csacf79
-
MD5
412910fbbe122dbc56496e41a8b72b54
-
SHA1
8a5f50d644c56702b7edb16ee368a64bef7aea24
-
SHA256
74b86eed28104c9f459d08d48044192745239f643d8896892acf46ce60deb3fc
-
SHA512
6f69dc1e2c357eaf2f47258b30e84ee2d80579ad1ea145b2385995c6a257ec8ddf5efb3608e77724c16f9a9b936c46b205b0133a3e141b1b84c2f9e8072da66d
-
SSDEEP
3072:ABN2XdPtLzQWbQ5p8F69mKG5DdWNNO/pOdj0V/E0PVPVGss:oYLMWbNPR+lE/3fG
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
2.2
237
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Targets
-
-
Target
file.exe
-
Size
176KB
-
MD5
412910fbbe122dbc56496e41a8b72b54
-
SHA1
8a5f50d644c56702b7edb16ee368a64bef7aea24
-
SHA256
74b86eed28104c9f459d08d48044192745239f643d8896892acf46ce60deb3fc
-
SHA512
6f69dc1e2c357eaf2f47258b30e84ee2d80579ad1ea145b2385995c6a257ec8ddf5efb3608e77724c16f9a9b936c46b205b0133a3e141b1b84c2f9e8072da66d
-
SSDEEP
3072:ABN2XdPtLzQWbQ5p8F69mKG5DdWNNO/pOdj0V/E0PVPVGss:oYLMWbNPR+lE/3fG
-
Detects Smokeloader packer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-