Extracted

• • Target
    Bооtsехеc-64.exe
  • Size 875.3MB
  • SHA256 ffad6d0e49cf4aa9eab671e596abe7ce1c4f1436569348c5c273e55f4ba9e3ff
  • MD5 d55f17432405109e185d99971b1e2273
  • SHA1 d92972c9d74cc3d6896aa283b80869cb4d66905e
  • SHA512 8f296a8894ac98ea6ebc33e41eb166ca03ac79c9a28eeb2299d658d16a2e2178737965ba11466fa34d3750d1fa00967824e3594de6feff73100e21da3f70b081
  • SSDEEP 49152:YRiblff3+PF0CRiWhhjkgZcr63AeZNFLMFrrBJ:YTimgeV4P
  • TLSH
    T1CD996C1B88915676E8A7F33DA9BB0151B66ABC49B73177C33D907A706E733C068B9304
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryspywarestealer

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    locales/resources/app.asar.unpacked/node_modules/btime/binding.node
  • Size 118KB
  • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
  • MD5 13a2579ed95366185a6247c9e4b9f0cc
  • SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
  • SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
  • SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
  • TLSH
    T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
  • Size 125KB
  • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
  • MD5 eeb1d1ea9fc3f870f292161cfa79850d
  • SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
  • SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
  • SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
  • TLSH
    T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
  • Size 118KB
  • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
  • MD5 6c12c930f974e5bc7872b58964f42359
  • SHA1 805c5c899c32535d2ee8b2bc12deefe5fdaae566
  • SHA512 f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
  • SSDEEP 3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
  • TLSH
    T18AC35C1BB3E540BBE1768138C8671A15D372B8214B61DBAF13A4465D1F237E0AD3EF62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    mpclient.dll
  • Size 2.2MB
  • SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
  • MD5 fcfda692c84f930191c2b8b1adbcddb9
  • SHA1 cda8edd09090da67fc542a4f839135fc156363f0
  • SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
  • SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
  • TLSH
    T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ef045f18455132bc2e22c24a3c41c8a9defense_evasiondiscoveryvidarspywarestealertrojan

  • Detects Vidar Stealer

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral10behavioral9