General
-
Target
a33d8b156dfd04d7fc01e001025a3c41.bin
-
Size
561.5MB
-
Sample
230610-cgdmdseg2t
-
MD5
a33d8b156dfd04d7fc01e001025a3c41
-
SHA1
eb0f18a573e706dd99093373cf02c9fe7c452c6f
-
SHA256
921877aae0f0f9c36ad1292bf81321d9d8c9331b15942aef71c3e60b1f229da0
-
SHA512
8e25072a64840d03b0cca87a2d004032a472ad951c8759291b47f6f820d9b3b01b56930ae32cd2172cefa9a2608f7b91578ace0c8fa0bb9128162f827063e984
-
SSDEEP
1572864:fhiZsTBhI4sMdg5s0LPvf4DqjNlpESwBgh9pcf2frte7hWt1:fwOlS4xgu0LPvwDqjnpEhum2ReG
Static task
static1
Behavioral task
behavioral1
Sample
a33d8b156dfd04d7fc01e001025a3c41.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a33d8b156dfd04d7fc01e001025a3c41.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
vidar
4.1
38301499c983a06784b6e63507c94e37
https://steamcommunity.com/profiles/76561199510444991
https://t.me/task4manager
-
profile_id_v2
38301499c983a06784b6e63507c94e37
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34
Targets
-
-
Target
a33d8b156dfd04d7fc01e001025a3c41.bin
-
Size
561.5MB
-
MD5
a33d8b156dfd04d7fc01e001025a3c41
-
SHA1
eb0f18a573e706dd99093373cf02c9fe7c452c6f
-
SHA256
921877aae0f0f9c36ad1292bf81321d9d8c9331b15942aef71c3e60b1f229da0
-
SHA512
8e25072a64840d03b0cca87a2d004032a472ad951c8759291b47f6f820d9b3b01b56930ae32cd2172cefa9a2608f7b91578ace0c8fa0bb9128162f827063e984
-
SSDEEP
1572864:fhiZsTBhI4sMdg5s0LPvf4DqjNlpESwBgh9pcf2frte7hWt1:fwOlS4xgu0LPvwDqjnpEhum2ReG
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-