General
-
Target
8007511dfd5ce8407f5dd7cbf47ded88.bin
-
Size
317KB
-
Sample
230130-xlsbkabg24
-
MD5
0302222c5f6ae0a1929259fdc296447c
-
SHA1
29f2732d625cfc997cfba157a9ce996f1ee9e9fb
-
SHA256
f0b7bc098d62ed600b823658012e458baebd13bb9d337ac895d43aab0a6dd83f
-
SHA512
366840d4722f49f2270e095aec1db6af03a553846655477f54d4bcf4906c17eb97cea4a8afa997f94a5e28e17a2a153776f0d5c062a9745597424a541cdfcc5c
-
SSDEEP
6144:MVxkdpXnVrgLagU19oy2p51mlRe9OIqUDh2PTCaDQgkqrVlxxHa:MV2NVgLagx1f9OI9QTKgZZx6
Static task
static1
Behavioral task
behavioral1
Sample
a831a3ead1f64d951fadcd5a15cf14e86f9b6b4d418f5fdb6e28acbe7d90264a.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
1.5
14
https://t.me/dahuasecurit
https://steamcommunity.com/profiles/76561199441999914
-
profile_id
14
Targets
-
-
Target
a831a3ead1f64d951fadcd5a15cf14e86f9b6b4d418f5fdb6e28acbe7d90264a.exe
-
Size
426KB
-
MD5
8007511dfd5ce8407f5dd7cbf47ded88
-
SHA1
36740f63336dde0d4b1960107f7b25ab17969852
-
SHA256
a831a3ead1f64d951fadcd5a15cf14e86f9b6b4d418f5fdb6e28acbe7d90264a
-
SHA512
1c868feb936d37656bf8e2353e0120d5d4d1f36395ca3043ff4c308d2cf47cce1dae2384b75f8b73b95643264e3aba64423fd227b6998cefda229dbce035ae2b
-
SSDEEP
12288:yEiSWvHCOGdMFkXqvoX6RR0TCtyYduHNI:YzvHCRMFkUoqRR0TCAYdE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-