General
-
Target
1f429959f63edf4060c4d0fdb91b1e831afa93b91f56f79628fa09c655550472
-
Size
772KB
-
Sample
211011-skl1yahegm
-
MD5
10d66bcc18244b64736ca6e7afd68d78
-
SHA1
ee143975ac1d499001c5c5f8611579320f32701c
-
SHA256
1f429959f63edf4060c4d0fdb91b1e831afa93b91f56f79628fa09c655550472
-
SHA512
13e98eb4ef8d553e0f3ee1178080f0c1c6dd417e30fc27c73d66f1d9d29a273d57d1007df092c30cab550c9bec304e5f69b9cb5934133cecffffadddf4ef6034
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
1f429959f63edf4060c4d0fdb91b1e831afa93b91f56f79628fa09c655550472
-
Size
772KB
-
MD5
10d66bcc18244b64736ca6e7afd68d78
-
SHA1
ee143975ac1d499001c5c5f8611579320f32701c
-
SHA256
1f429959f63edf4060c4d0fdb91b1e831afa93b91f56f79628fa09c655550472
-
SHA512
13e98eb4ef8d553e0f3ee1178080f0c1c6dd417e30fc27c73d66f1d9d29a273d57d1007df092c30cab550c9bec304e5f69b9cb5934133cecffffadddf4ef6034
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-