Extracted

• • Target

    VDeck Setup.exe.vir

  • Size

    40.0MB

  • MD5

    b9d8bed2a79c0b77af4640a28900d891

  • SHA1

    01ca342cdb9e1ae97799771001eca8cface9afc6

  • SHA256

    1b7e4f1adc6780bc528758fd206329150a6c0d61be13b4d186de4b80ad604a03

  • SHA512

    e1465a42c83b0c71aa9d00343d8fe548dbf623802623ca9a20909bc16e1145ba1e6ba72b8ddb9e65c3aff4df22a2a0fb2fa474a494b23fbc15a641875eddb7f0

  • SSDEEP

    786432:56pXKzUhllZSObZChkvj+FKVtv5cUxcppRQkvheVepVNn58lB45aBowl2v5M:5QKzOKhkKAVtCnppGV458lBsa6wk6

  Score

  10^/10

  hijackloaderstealccloregod8credential_accessdiscoveryevasionexecutionloaderpersistencespywarestealerrhadamanthys

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Modifies visibility of file extensions in Explorer

    evasion

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    persistence

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2