General
-
Target
Use_55500_As_Passw0rd.rar
-
Size
4.1MB
-
Sample
230125-l83j9sff75
-
MD5
fab26682ba1a848484d1b6ebda73106d
-
SHA1
c0f7c0704bf5fc937fba2048c6c45ad25a970fde
-
SHA256
4a09459d095915e4ea732d5fd9aa453e0a05603baa711696bcc9c9f479cbcecf
-
SHA512
abfe723376fd80e6068e16d5a1931143adf67743b75c08299b7c0891468578f90e02f01403079e1fad5e376d9224160fe92cc52a8d0bc91e57289c9ad59acd68
-
SSDEEP
98304:S4gq6GfAH3NqJseMsfLJk/PtYZPD4LUPw7HyFo:S4gq6G446ePLJk/6DpPwrN
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
2.2
15
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
15
Targets
-
-
Target
Setup.exe
-
Size
470.6MB
-
MD5
5909ae2b1c956d4c13b1e6041fdb7f9d
-
SHA1
8e500369fda8625e0c153c07aabc3ca383d49d44
-
SHA256
b4b353183fc52980c539601936d8a3774e78f4f8d44e64e8e7082427eed06dbf
-
SHA512
de385015cb140cbeed61dfd6f923a1b8db054e5cb062e6ca8be0a94de9bccbe3ef3cb1e9fcceb14a0aa64f327e35efc449c47e7d15cb9e358ef8bc80ba2411d2
-
SSDEEP
49152:FDHrATS9GPSiK6Wl6n+XXZEk4fvXAFXr4ND9pv/OSt5GjhCbhontKH5ck6JjH:FDHoPnWoUSXhjpv//t0jhC+ntkOn
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-