General
-
Target
e4aa8c48a0cc42e418ee912cebac96086b4bf26a87d427360d4a6d02b65a8da1
-
Size
743KB
-
Sample
211015-bzw11sbbdr
-
MD5
1f502e8fa5dc93c68e1a7c29b180b5ad
-
SHA1
0edaeec6dcae02f6594a0df9edd6b7c336833ffa
-
SHA256
e4aa8c48a0cc42e418ee912cebac96086b4bf26a87d427360d4a6d02b65a8da1
-
SHA512
703d3073951bfdabbcb79d50abd6dfdca3ddffadf24f3eaf636eeebe513aac14f8c7adbb579c430008f6450fad7f2bc74f8fc29f63882ae872fba9accdb82400
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
e4aa8c48a0cc42e418ee912cebac96086b4bf26a87d427360d4a6d02b65a8da1
-
Size
743KB
-
MD5
1f502e8fa5dc93c68e1a7c29b180b5ad
-
SHA1
0edaeec6dcae02f6594a0df9edd6b7c336833ffa
-
SHA256
e4aa8c48a0cc42e418ee912cebac96086b4bf26a87d427360d4a6d02b65a8da1
-
SHA512
703d3073951bfdabbcb79d50abd6dfdca3ddffadf24f3eaf636eeebe513aac14f8c7adbb579c430008f6450fad7f2bc74f8fc29f63882ae872fba9accdb82400
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-