Description
Ransomware which is a variant of the STOP family.
e564e7021006ff33c00f2965fa3d0fc1d7388434e94610baa83ebcf17a335501
850KB
211020-g5ab4agfd3
50103ed2f41f7a25c0d858f1dd894887
40a9be09d106102d6a44e75fecfcbc7504435488
e564e7021006ff33c00f2965fa3d0fc1d7388434e94610baa83ebcf17a335501
c945a397e73c75c9d78e516770a9beb44f0a14bb3a168650c8e326fb9bf0b5386fc8d38eaf4eb19ec9039f45d36d73e5fa5c38bc101d1cf712a99394310dfda4
Family | vidar |
Version | 41.5 |
Botnet | 517 |
C2 |
https://mas.to/@xeroxxx |
Attributes |
profile_id 517 |
Family | djvu |
C2 |
http://rlrz.org/fhsgtsspen6 |
e564e7021006ff33c00f2965fa3d0fc1d7388434e94610baa83ebcf17a335501
50103ed2f41f7a25c0d858f1dd894887
850KB
40a9be09d106102d6a44e75fecfcbc7504435488
e564e7021006ff33c00f2965fa3d0fc1d7388434e94610baa83ebcf17a335501
c945a397e73c75c9d78e516770a9beb44f0a14bb3a168650c8e326fb9bf0b5386fc8d38eaf4eb19ec9039f45d36d73e5fa5c38bc101d1cf712a99394310dfda4
Ransomware which is a variant of the STOP family.
Vidar is an infostealer based on Arkei stealer.
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up Uninstall key entries in the registry to enumerate software on the system.
Uses a legitimate IP lookup service to find the infected system's external IP.