banload | 70f76a40bc72139f4aeb0a3516a86908f30595740015669f3b358473de6d9ed5 | Triage

Sharing

General

Target

#Frée-FɨLéŜ-!PằŜSwṟo͍d--63180.zip
Size

29.7MB
Sample

240424-tn221ada8v
MD5

132080820f6bc2dbfc24e3024ee3c333
SHA1

be7eaa59f75baaabcbfd4247433d96469b0d0d71
SHA256

70f76a40bc72139f4aeb0a3516a86908f30595740015669f3b358473de6d9ed5
SHA512

9f6de8fa4dedb419971b30cdbf011959f1a2cd6566714a40ae9b71c8b14f198786bd7477bcfa93e56fda61db97d14bb0e5b561769561a4b4348fcc04fd6eb45e
SSDEEP

786432:rcRX9OksNSIwM29yc36PX9i9sSUbrSLEe5pp0l+bGF:rcRX9CNXo9yXX9esLbr8/5pp0wbGF

Score

10^/10

banload vidar 3c6ffb3181118d4e1071419a800b7369 downloader dropper evasion persistence stealer trojan

Malware Config

Extracted

Family

vidar

Botnet

3c6ffb3181118d4e1071419a800b7369

C2

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

profile_id_v2
3c6ffb3181118d4e1071419a800b7369
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Targets

- Target
  
  #Frée-FɨLéŜ-!PằŜSwṟo͍d--63180/Setup.exe
- Size
  
  8.5MB
- MD5
  
  98169506fec94c2b12ba9930ad704515
- SHA1
  
  bce662a9fb94551f648ba2d7e29659957fd6a428
- SHA256
  
  9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
- SHA512
  
  7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
- SSDEEP
  
  196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK
Score

10^/10

banload vidar 3c6ffb3181118d4e1071419a800b7369 downloader dropper evasion persistence stealer trojan
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

banloadvidar3c6ffb3181118d4e1071419a800b7369downloaderdropperevasionpersistencestealertrojan