Extracted

• • Target

    virus/About/IA2Marshal.dll

  • Size

    77KB

  • MD5

    31fcd15b9a06ac591b130921b0b006c8

  • SHA1

    81a485e90a33ced93033ae9a4e079639bb283a31

  • SHA256

    70db8976911089b12d584faa1bc48cbbccffa8e79afc70273cc4a8352a0dc615

  • SHA512

    1125e34a0270af7135040e2ab44a5ca749a230ad34bc23b60f3ac529579a21b4d72bf0cf574352469b97c66515cf2d2792e43ab29d9888131053be34d3a37249

  • SSDEEP

    768:67afxi7heDjJNhM1cUPKRK8MJL6cgNkBewiLW3WwKWeV:yw5DFNhMGUPKRK8MJGhG/iLay

  Score

  1^/10
  behavioral1behavioral2

• • Target

    virus/About/qtmultimedia_m3u.dll

  • Size

    33KB

  • MD5

    e5edd622c8db0f7caca1fc1bd58a0c48

  • SHA1

    1f1ff78d2eae799e2abf06252265600eab3f4551

  • SHA256

    dae45e4b553bdb471bb97b75060829d78f98dd824ebd765ceb9347af7697addc

  • SHA512

    e8f9be815ab30a158dbd050085e1418307ef86f0cfdf8833afdde44c52fca66d7ad452e159d1cf3cb96ca32ee60c639998a6eea6d1933f6a34f06b41a5d99710

  • SSDEEP

    768:sCV1YEh1QGs52809gKO0aiZnVbZnkN2661tq:sCVCEh1QGs5m9gKOonP66u

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    virus/Files/Sourse2/qtmultimedia_m3u.dll

  • Size

    33KB

  • MD5

    e5edd622c8db0f7caca1fc1bd58a0c48

  • SHA1

    1f1ff78d2eae799e2abf06252265600eab3f4551

  • SHA256

    dae45e4b553bdb471bb97b75060829d78f98dd824ebd765ceb9347af7697addc

  • SHA512

    e8f9be815ab30a158dbd050085e1418307ef86f0cfdf8833afdde44c52fca66d7ad452e159d1cf3cb96ca32ee60c639998a6eea6d1933f6a34f06b41a5d99710

  • SSDEEP

    768:sCV1YEh1QGs52809gKO0aiZnVbZnkN2661tq:sCVCEh1QGs5m9gKOonP66u

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    virus/Setup.exe

  • Size

    693.1MB

  • MD5

    01ab745aa7f4a530b4f3146dcb60ff4b

  • SHA1

    39ff04624c5b47a3af6abe638151ed7fdd55def1

  • SHA256

    d1cbd311fc4c3fb88682cbd37f6904a35f7133074b7990a4eea6cdfff5414a1e

  • SHA512

    76494dc91475e1ab9ea54a8131e8dea61cf0cb7530593e19fae6805077479209a2631fea500a9151473ba4e674797ee627151f9aca4a48f95f1c4a8f3d7cb47b

  • SSDEEP

    393216:m3Mc7el0z16ExHVojm9U3NkhwYkwrYTx2xztNaSyc:wMcqaR6Vjm9MWprMTgL

  Score

  10^/10

  vidarxmrigcredential_accessdefense_evasiondiscoveryminerpersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Enumerates processes with tasklist

    discovery
  behavioral7behavioral8