General
-
Target
usfive_20210725-104522
-
Size
654KB
-
Sample
210725-r8gqqpz8as
-
MD5
9f5e2e5d9d36630be00cc4b33f9596bc
-
SHA1
7609f400392ac6fe6a82a953c65ea2193209c4d4
-
SHA256
3a204809754f292e076e1216f7c2e9817dd6069cbdbc34f6f846c1daa55e6ca4
-
SHA512
d0ab067e61744f31adc5e77ea001f7197379980d2eea7e2e361687b4141d86d7a9e9fdf9182d6fa123e064eedc883ab608cedfe5df4b00073a14bad298937d6e
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210725-104522.exe
Resource
win7v20210410
Malware Config
Extracted
vidar
39.7
818
https://shpak125.tumblr.com/
-
profile_id
818
Targets
-
-
Target
usfive_20210725-104522
-
Size
654KB
-
MD5
9f5e2e5d9d36630be00cc4b33f9596bc
-
SHA1
7609f400392ac6fe6a82a953c65ea2193209c4d4
-
SHA256
3a204809754f292e076e1216f7c2e9817dd6069cbdbc34f6f846c1daa55e6ca4
-
SHA512
d0ab067e61744f31adc5e77ea001f7197379980d2eea7e2e361687b4141d86d7a9e9fdf9182d6fa123e064eedc883ab608cedfe5df4b00073a14bad298937d6e
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-