General
-
Target
3ef3a53ac43e91eaea9d1b4c4b418882f41563cae0cd4b046ff86c361b04f4a0
-
Size
725KB
-
Sample
211015-jwb6fabdek
-
MD5
5f993050165a67f0dc0bf63c65d64aaa
-
SHA1
b976c5511023cca43ac2c5b2b408da189c5573ef
-
SHA256
3ef3a53ac43e91eaea9d1b4c4b418882f41563cae0cd4b046ff86c361b04f4a0
-
SHA512
6c2727b503a12b986067c9dadd7015228282c1ab3e480c2074b3da58f8248189865c6edbececdae2bb2d40500cfedb94ddcced396f3f6fc18f1b7fd628aa21a8
Static task
static1
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Targets
-
-
Target
3ef3a53ac43e91eaea9d1b4c4b418882f41563cae0cd4b046ff86c361b04f4a0
-
Size
725KB
-
MD5
5f993050165a67f0dc0bf63c65d64aaa
-
SHA1
b976c5511023cca43ac2c5b2b408da189c5573ef
-
SHA256
3ef3a53ac43e91eaea9d1b4c4b418882f41563cae0cd4b046ff86c361b04f4a0
-
SHA512
6c2727b503a12b986067c9dadd7015228282c1ab3e480c2074b3da58f8248189865c6edbececdae2bb2d40500cfedb94ddcced396f3f6fc18f1b7fd628aa21a8
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-