General
-
Target
695faffc0a0cb66b81c96b42d48aa756debaf3245624e47fd27f4555248a4df5
-
Size
711KB
-
Sample
210922-zttwgageam
-
MD5
dfc7ce8d606fe5e7ca93f74cfd3f2d62
-
SHA1
c7ad8566440626728626d65090fa84960a0ff426
-
SHA256
695faffc0a0cb66b81c96b42d48aa756debaf3245624e47fd27f4555248a4df5
-
SHA512
e984e6964696b08396a41008494b738bca03e8899a3f7400226aa7d005161fba6e5f04e64e582defd845d33db94f37399f5841dcdffafb1f60a628305f3a0e49
Static task
static1
Malware Config
Extracted
vidar
40.9
828
https://stacenko668.tumblr.com/
-
profile_id
828
Targets
-
-
Target
695faffc0a0cb66b81c96b42d48aa756debaf3245624e47fd27f4555248a4df5
-
Size
711KB
-
MD5
dfc7ce8d606fe5e7ca93f74cfd3f2d62
-
SHA1
c7ad8566440626728626d65090fa84960a0ff426
-
SHA256
695faffc0a0cb66b81c96b42d48aa756debaf3245624e47fd27f4555248a4df5
-
SHA512
e984e6964696b08396a41008494b738bca03e8899a3f7400226aa7d005161fba6e5f04e64e582defd845d33db94f37399f5841dcdffafb1f60a628305f3a0e49
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-