General
-
Target
c8cb1b41dee6a2fc6856f98ff939cb3406c23254ee6b66351b1bb311a6376b62
-
Size
636KB
-
Sample
211012-q48ypscdcr
-
MD5
c98b4225519747edfab1a6bdeba50416
-
SHA1
83de23deb9a2344d26333d6d7462cfc3ba842e1b
-
SHA256
c8cb1b41dee6a2fc6856f98ff939cb3406c23254ee6b66351b1bb311a6376b62
-
SHA512
6393c313f45bf802b09c60cca50b170adb361b72da3f8d22700f5b0dc61a7a60e802c413f1e28e5d66c0332afaf66536b1b0f513124b531b9f407f0818fbc151
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
c8cb1b41dee6a2fc6856f98ff939cb3406c23254ee6b66351b1bb311a6376b62
-
Size
636KB
-
MD5
c98b4225519747edfab1a6bdeba50416
-
SHA1
83de23deb9a2344d26333d6d7462cfc3ba842e1b
-
SHA256
c8cb1b41dee6a2fc6856f98ff939cb3406c23254ee6b66351b1bb311a6376b62
-
SHA512
6393c313f45bf802b09c60cca50b170adb361b72da3f8d22700f5b0dc61a7a60e802c413f1e28e5d66c0332afaf66536b1b0f513124b531b9f407f0818fbc151
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-