General
-
Target
831f4d040c8215e670f8bce2d63855fd70c8f54a1ae2644a5cdce1eb7890d8ef
-
Size
760KB
-
Sample
211011-xljpeshhdj
-
MD5
0fa40777f277021341a92c4f1346e597
-
SHA1
a85a06c49989df9ecfe8156f7eb62b7b621cc1d8
-
SHA256
831f4d040c8215e670f8bce2d63855fd70c8f54a1ae2644a5cdce1eb7890d8ef
-
SHA512
b043ce57ea0b3d23ce5ae89cc839cad6ece7b6ac5f77499d021c14e289228bcc5ff642e30a2e040dc0ac4577e9b68f742109e80122709e8e145412686c877f40
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
831f4d040c8215e670f8bce2d63855fd70c8f54a1ae2644a5cdce1eb7890d8ef
-
Size
760KB
-
MD5
0fa40777f277021341a92c4f1346e597
-
SHA1
a85a06c49989df9ecfe8156f7eb62b7b621cc1d8
-
SHA256
831f4d040c8215e670f8bce2d63855fd70c8f54a1ae2644a5cdce1eb7890d8ef
-
SHA512
b043ce57ea0b3d23ce5ae89cc839cad6ece7b6ac5f77499d021c14e289228bcc5ff642e30a2e040dc0ac4577e9b68f742109e80122709e8e145412686c877f40
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-