General
-
Target
ce3181bb4dcf608b065a2034a4b311316a4b0d04484ed656d741af24be39f118
-
Size
657KB
-
Sample
210921-r2f1kscdhp
-
MD5
83e13d7e8d1f64ea857a096ca01acc02
-
SHA1
dc007eb1acd196f2fceb0db36e00bcf44a1eb4f1
-
SHA256
ce3181bb4dcf608b065a2034a4b311316a4b0d04484ed656d741af24be39f118
-
SHA512
a9b03401abb08236ecd5692f0038ada21a9972abc008f39b016d592f369b9bad1168af638e6cfb6a4dc075ba14bd3e9508c8972fc1568279a1883e788dc23d45
Static task
static1
Malware Config
Extracted
vidar
40.8
828
https://pavlovoler.tumblr.com/
-
profile_id
828
Targets
-
-
Target
ce3181bb4dcf608b065a2034a4b311316a4b0d04484ed656d741af24be39f118
-
Size
657KB
-
MD5
83e13d7e8d1f64ea857a096ca01acc02
-
SHA1
dc007eb1acd196f2fceb0db36e00bcf44a1eb4f1
-
SHA256
ce3181bb4dcf608b065a2034a4b311316a4b0d04484ed656d741af24be39f118
-
SHA512
a9b03401abb08236ecd5692f0038ada21a9972abc008f39b016d592f369b9bad1168af638e6cfb6a4dc075ba14bd3e9508c8972fc1568279a1883e788dc23d45
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-