vidar

General

Target
ce81939f138c0b4ed1b2e4ef76a042af.exe
Size 731KB
Sample210830-t2vyv65yq2
SHA256 b5ebaa343b2503597f1357226444b151f4e06f373fddf18e3c296cb386954b92
MD5 ce81939f138c0b4ed1b2e4ef76a042af
SHA1 ebdfc7db447d6586e5a9080d3c21403f4f5d05d8
SHA512 f4dfc766bb710f81cd5c26550819aa76371946e3e7b65d2d686c23ec5856010c5d6aa1e73cabe32320156c48a44acb3420c71d1807776f91cd755a0728e5b5d7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  ce81939f138c0b4ed1b2e4ef76a042af.exe
- Size 731KB
- SHA256 b5ebaa343b2503597f1357226444b151f4e06f373fddf18e3c296cb386954b92
- MD5 ce81939f138c0b4ed1b2e4ef76a042af
- SHA1 ebdfc7db447d6586e5a9080d3c21403f4f5d05d8
- SHA512 f4dfc766bb710f81cd5c26550819aa76371946e3e7b65d2d686c23ec5856010c5d6aa1e73cabe32320156c48a44acb3420c71d1807776f91cd755a0728e5b5d7
- MD5 SHA1 SHA512
Score

10^/10

vidar discovery spyware stealer suricata
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2