vidar

General

Target
67ae8bf0434b992f46512d70b832cc79.exe
Size 714KB
Sample210928-jftesabbbq
SHA256 9fe9d2f571a89db6dd353ab7e6cc5519799eb2454827a10a704436401d010b21
MD5 67ae8bf0434b992f46512d70b832cc79
SHA1 3d1908e6d690a63f063eaa74acd93c47e159bdf8
SHA512 e167c49238e01fdbaf46990d18e995d7639914566bef01390870785f8952fe41069397090112f37c1354d0cfcc95e806f2050a57b6e721ecab304f5d3d08836b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  67ae8bf0434b992f46512d70b832cc79.exe
- Size 714KB
- SHA256 9fe9d2f571a89db6dd353ab7e6cc5519799eb2454827a10a704436401d010b21
- MD5 67ae8bf0434b992f46512d70b832cc79
- SHA1 3d1908e6d690a63f063eaa74acd93c47e159bdf8
- SHA512 e167c49238e01fdbaf46990d18e995d7639914566bef01390870785f8952fe41069397090112f37c1354d0cfcc95e806f2050a57b6e721ecab304f5d3d08836b
- MD5 SHA1 SHA512
Score

10^/10

vidar discovery spyware stealer suricata
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2