General
-
Target
77cd68e6328a5b58a625e6190b56713e62b37db8fcae04d9b6f7021745c4603f
-
Size
322KB
-
Sample
230411-25v9sahf6w
-
MD5
cafc8351bc21c41083793db0f57b6aa8
-
SHA1
8cb45d0e477aac3f7efdef9226c295a1fffde756
-
SHA256
77cd68e6328a5b58a625e6190b56713e62b37db8fcae04d9b6f7021745c4603f
-
SHA512
2fcff8f290c4c4c1ec5c33e7bad4db731d3a9f2106df92e8ceeaaf1ab6d4ada5957cee3b5e5f0cce2c5e2e8afb6f408e2fc37a437a77972950e49b489a2be514
-
SSDEEP
6144:fYUy3y9ElcdE0vVBNdAcKAl39yy3hPXCJMys:1IytqgVbRTx3h/CJ
Static task
static1
Behavioral task
behavioral1
Sample
77cd68e6328a5b58a625e6190b56713e62b37db8fcae04d9b6f7021745c4603f.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
vidar
3.4
e749025c61b2caca10aa829a9e1a65a1
https://steamcommunity.com/profiles/76561199494593681
https://t.me/auftriebs
-
profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
-
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Extracted
laplas
http://185.106.92.74
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Targets
-
-
Target
77cd68e6328a5b58a625e6190b56713e62b37db8fcae04d9b6f7021745c4603f
-
Size
322KB
-
MD5
cafc8351bc21c41083793db0f57b6aa8
-
SHA1
8cb45d0e477aac3f7efdef9226c295a1fffde756
-
SHA256
77cd68e6328a5b58a625e6190b56713e62b37db8fcae04d9b6f7021745c4603f
-
SHA512
2fcff8f290c4c4c1ec5c33e7bad4db731d3a9f2106df92e8ceeaaf1ab6d4ada5957cee3b5e5f0cce2c5e2e8afb6f408e2fc37a437a77972950e49b489a2be514
-
SSDEEP
6144:fYUy3y9ElcdE0vVBNdAcKAl39yy3hPXCJMys:1IytqgVbRTx3h/CJ
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-