General

  • Target

    49f815a8bf7ac49e86f00c2f93d6b31022d7c8adee1bcae2db9fa9aff705c2d6

  • Size

    593KB

  • Sample

    210926-3v2jgsfdf8

  • MD5

    4fe9c30d2820ce6a1da9898c14830bde

  • SHA1

    4d5e8fe3da310817d9d5522751dd2a89b130d7f6

  • SHA256

    49f815a8bf7ac49e86f00c2f93d6b31022d7c8adee1bcae2db9fa9aff705c2d6

  • SHA512

    285327dc20d320d8b978c59f8c6e5d7af0f3c8f7356db09aa6505e3a12d876d0db7f985fcd6e131f941b95f36b63adacedd66c7efbf316ef8dde35c5e2bc26cd

Malware Config

Targets

    • Target

      49f815a8bf7ac49e86f00c2f93d6b31022d7c8adee1bcae2db9fa9aff705c2d6

    • Size

      593KB

    • MD5

      4fe9c30d2820ce6a1da9898c14830bde

    • SHA1

      4d5e8fe3da310817d9d5522751dd2a89b130d7f6

    • SHA256

      49f815a8bf7ac49e86f00c2f93d6b31022d7c8adee1bcae2db9fa9aff705c2d6

    • SHA512

      285327dc20d320d8b978c59f8c6e5d7af0f3c8f7356db09aa6505e3a12d876d0db7f985fcd6e131f941b95f36b63adacedd66c7efbf316ef8dde35c5e2bc26cd

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks