General
-
Target
cb9f24d2bb0721249c5314836df019c18355ddd928c0c01ca6f950d7a8698db5
-
Size
633KB
-
Sample
211012-hmqf2abfcl
-
MD5
6f7433133ebf467c0876cea67fbbda15
-
SHA1
e29a5c0bccaddddc9e526fa3d0e57c0e5f8cc78d
-
SHA256
cb9f24d2bb0721249c5314836df019c18355ddd928c0c01ca6f950d7a8698db5
-
SHA512
d7323b8c3a7a8b1a7a7fe9010a8b8c68fff34f82da19aa3ca6ad20cf3e00091c956b476af0e122133d0513af325d9adf4dfadc8b83e2ba8622b8bd5070730e5c
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
cb9f24d2bb0721249c5314836df019c18355ddd928c0c01ca6f950d7a8698db5
-
Size
633KB
-
MD5
6f7433133ebf467c0876cea67fbbda15
-
SHA1
e29a5c0bccaddddc9e526fa3d0e57c0e5f8cc78d
-
SHA256
cb9f24d2bb0721249c5314836df019c18355ddd928c0c01ca6f950d7a8698db5
-
SHA512
d7323b8c3a7a8b1a7a7fe9010a8b8c68fff34f82da19aa3ca6ad20cf3e00091c956b476af0e122133d0513af325d9adf4dfadc8b83e2ba8622b8bd5070730e5c
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-