General
-
Target
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a.bin
-
Size
938KB
-
Sample
250701-jqlspa1zgy
-
MD5
e592539dd8aebbd1a37f08f716387615
-
SHA1
5bbd6b6d843ff467cc6fdecf20243fc2428a64f3
-
SHA256
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a
-
SHA512
399d1d7c1e91e7719870a81cb631c596542a3ab158e4b7babbfc706b1539fa19f06c831c66fd350544752286651437b36c81933b7222d01c3f7c8cea46357603
-
SSDEEP
24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aHuB:DTvC/MTQYxsWR7aHu
Static task
static1
Behavioral task
behavioral1
Sample
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a.exe
Resource
win11-20250619-en
Malware Config
Extracted
http://185.156.72.2/testmine/random.exe
Extracted
http://185.156.72.2/testmine/random.exe
Extracted
gcleaner
45.91.200.135
Extracted
lumma
https://rbmlh.xyz/lakd
https://pacwpw.xyz/qwpr
https://comkxjs.xyz/taox
https://unurew.xyz/anhd
https://trsuv.xyz/gait
https://sqgzl.xyz/taoa
https://cexpxg.xyz/airq
https://urarfx.xyz/twox
https://liaxn.xyz/nbzh
-
build_id
e3f28ba146ffcdaf867dab6c13fae9d3414e4138ab
Extracted
vidar
14.4
5838abba2c7ca0756153b41aab8534b5
https://t.me/q0l0o
https://steamcommunity.com/profiles/76561199872233764
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0
Extracted
vidar
14.3
0563f7b7ace99077cac73375f6f7cbf9
https://t.me/l07tp
https://steamcommunity.com/profiles/76561199869630181
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0
Targets
-
-
Target
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a.bin
-
Size
938KB
-
MD5
e592539dd8aebbd1a37f08f716387615
-
SHA1
5bbd6b6d843ff467cc6fdecf20243fc2428a64f3
-
SHA256
bca5ec22f6d485bee681dc4257d0fe88e085017a984d35e0618730b5e413958a
-
SHA512
399d1d7c1e91e7719870a81cb631c596542a3ab158e4b7babbfc706b1539fa19f06c831c66fd350544752286651437b36c81933b7222d01c3f7c8cea46357603
-
SSDEEP
24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aHuB:DTvC/MTQYxsWR7aHu
-
Detect Vidar Stealer
-
Gcleaner family
-
Lumma family
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Contacts a large (572) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
7System Information Discovery
5System Location Discovery
1System Language Discovery
1Virtualization/Sandbox Evasion
2