Extracted

• • Target

    S0FTWARE.rar

  • Size

    21.4MB

  • MD5

    9e836a69e0bbdc74c826da13227f78b7

  • SHA1

    ae7b5cba4cf8bd0baf276785d073fbc4cc84b1df

  • SHA256

    4aaa1052ec1148f52506afe6087c885b979b2b4923df82b142eb007d160656d5

  • SHA512

    10997f3544277d4e3db862fbef2e1a373ef0b700b53eef8de26452cf9facc60afbb12ade59c2783a7a1ca7d6cba5e4eceb46f58cad909f3c4f38168a61e6a886

  • SSDEEP

    393216:1RFfxJKFA4VNEMPa/TacMM8McH3YYCKoEt2WW8VqQhqfyDCQ8ppqb76U/q:DFfaVNyaXM8MKCK5z3Vqqqq+T+Nq

  Score

  10^/10

  vidarxmrig346a77fbabba142b23c256004b5a7c5dcredential_accessdiscoveryevasionexecutionminerpersistencespywarestealerthemidatrojanupx

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1