General

  • Target

    ed3a8374aff45cfadc4d4ee765283407272f90d6a352fc1fe2eca15f30fdb5c0

  • Size

    556KB

  • Sample

    210227-qrf4tkgywe

  • MD5

    5c4d0f7d7772ba6a6d19eb5a15f4811c

  • SHA1

    f0219d065adcb64faaa28132fd37b04cbf530cd0

  • SHA256

    ed3a8374aff45cfadc4d4ee765283407272f90d6a352fc1fe2eca15f30fdb5c0

  • SHA512

    26a0894d4ec22ba33fd145f9001298d02426b4a2bdc3db62b37f3c1cb9f69de392b75e455548f1b041924178f3dc2bfd204afd0f5d15d0c396bb0c6bc5109ede

Malware Config

Targets

    • Target

      ed3a8374aff45cfadc4d4ee765283407272f90d6a352fc1fe2eca15f30fdb5c0

    • Size

      556KB

    • MD5

      5c4d0f7d7772ba6a6d19eb5a15f4811c

    • SHA1

      f0219d065adcb64faaa28132fd37b04cbf530cd0

    • SHA256

      ed3a8374aff45cfadc4d4ee765283407272f90d6a352fc1fe2eca15f30fdb5c0

    • SHA512

      26a0894d4ec22ba33fd145f9001298d02426b4a2bdc3db62b37f3c1cb9f69de392b75e455548f1b041924178f3dc2bfd204afd0f5d15d0c396bb0c6bc5109ede

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks