General

  • Target

    1a_bin.zip

  • Size

    9.9MB

  • MD5

    06769e1f6b1d46f06b95a31f7926a81c

  • SHA1

    8443761f0aabf1a8f2e68a6847dfc69cc424c97e

  • SHA256

    c33bbc9a04b5d8e0dd321f4c3f4b254bf4b78dbf126767716b9696e6a2fceabe

  • SHA512

    7abd3be15f6c6ca66eb7feba8f8e39dcf2ad07d578e004ba6b3c130738f43165e59521e8ddfa15fe051c36669c9b623e18b133f141cf6c873781acf4e3724363

  • SSDEEP

    196608:wYAn31AbtpT5ylm/SNNy4giLvlN0nv5iTqKaQUJO7rPh1:gn31y7Tym/69LvlN0nvA7jUqD

Score
10/10

Malware Config

Signatures

  • Detect Vidar Stealer 1 IoCs
  • Vidar family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 1a_bin.zip
    .zip

    Password: acid1

  • bin_acid1.zip
    .zip

    Password: acid1

  • 1qb_acid.exe
    .exe windows:4 windows x64 arch:x64

    Password: acid1

    5e0af64c3e9a49e104c9c45fdab56d68


    Code Sign

    Headers

    Imports

    Sections

  • bbi/Qt5Core.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    6d44a16d5801e1cdb9b3ba4cb45314b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bbi/Qt5Gui.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    ddcb78f3a4297344c620aa83af64ddfd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bbi/Qt5Network.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    c0e2c58de25ce77b283ad911460cea11


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bbi/nbjq1/libEGL.dll
    .dll windows:4 windows x86 arch:x86

    Password: acid1

    c528ebb689f5d5acecf9ec15a0e398b9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bbi/nbjq1/libeay32.dll
    .dll windows:4 windows x86 arch:x86

    Password: acid1

    32d53878cd567e62bc29491eaf366d6e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bbi/nbjq1/libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    Password: acid1

    04f9a5136edc374e78bc81dc8b0d07af


    Headers

    Imports

    Exports

    Sections

  • bbi/nbjq1/qtwebengine_resources.pak
    .js
  • bbi/nbjq1/qtwebengine_resources_100p.pak
    .js
  • bbi/nbjq1/qtwebengine_resources_200p.pak
    .js
  • libcares-2.dll
    .dll windows:6 windows x64 arch:x64

    b670439bb830c3903193b7925a9c656c


    Headers

    Imports

    Exports

    Sections

  • local/hs_err_pid14620.log
  • local/hs_err_pid5944.log
  • local/hs_err_pid8760.log
  • local/hs_err_pid932.log
  • local/lua/conf/logging.properties
  • local/lua/conf/management/jmxremote.access
  • local/lua/conf/management/jmxremote.password.template
  • local/lua/conf/management/management.properties
  • local/lua/conf/net.properties
  • local/lua/conf/security/java.policy
  • local/lua/conf/security/java.security
  • local/lua/conf/security/policy/README.txt
  • local/lua/conf/security/policy/limited/default_US_export.policy
  • local/lua/conf/security/policy/limited/default_local.policy
  • local/lua/conf/security/policy/limited/exempt_local.policy
  • local/lua/conf/security/policy/unlimited/default_US_export.policy
  • local/lua/conf/security/policy/unlimited/default_local.policy
  • local/lua/conf/sound.properties
  • local/updater.log
  • local/updater.log.old
  • local/usercache.json
  • nasrallah_x86.dll