General
-
Target
376b8f3c005d39067abeed0d0df58696495739e432377d138f06b9da0473d10d
-
Size
127KB
-
Sample
211110-lx1xasgfh2
-
MD5
26c464453144b82f4a2f8b868084651a
-
SHA1
ff89484718114020aec3e7d40e5708694070e5cc
-
SHA256
376b8f3c005d39067abeed0d0df58696495739e432377d138f06b9da0473d10d
-
SHA512
1088072c2cd99f911a476b3d3dc6e13464e1b6fc6c91cf3cae1cca568bb76b9dc92c41f0992d66232943128f59d67a16d4459cd6e2a6a1f7de274884650ec52a
Static task
static1
Behavioral task
behavioral1
Sample
376b8f3c005d39067abeed0d0df58696495739e432377d138f06b9da0473d10d.exe
Resource
win10-en-20211014
Malware Config
Extracted
vidar
48.1
754
-
profile_id
754
Targets
-
-
Target
376b8f3c005d39067abeed0d0df58696495739e432377d138f06b9da0473d10d
-
Size
127KB
-
MD5
26c464453144b82f4a2f8b868084651a
-
SHA1
ff89484718114020aec3e7d40e5708694070e5cc
-
SHA256
376b8f3c005d39067abeed0d0df58696495739e432377d138f06b9da0473d10d
-
SHA512
1088072c2cd99f911a476b3d3dc6e13464e1b6fc6c91cf3cae1cca568bb76b9dc92c41f0992d66232943128f59d67a16d4459cd6e2a6a1f7de274884650ec52a
Score10/10-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-