General
-
Target
eufive_20211111-095210
-
Size
767KB
-
Sample
211111-ks3pnagahl
-
MD5
e85615ee7bdfda76039c4403f583a6b0
-
SHA1
10d48c76851bc65eb1f063d8b5fbdcf4bfd50c0f
-
SHA256
3031897cf889210dccb36904e71aad0e44019d64fee9e1abb50ea388a194f286
-
SHA512
e6934068e4c5c5ac760bed2e02ba9dab5404e5c6f53cbaadffa5468a7a88c7aa4ca697140e554029024eb7d54e6392a2d3e26c6532c48458053c632c5922e399
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20211111-095210.exe
Resource
win7-en-20211014
Malware Config
Extracted
vidar
48.1
824
-
profile_id
824
Targets
-
-
Target
eufive_20211111-095210
-
Size
767KB
-
MD5
e85615ee7bdfda76039c4403f583a6b0
-
SHA1
10d48c76851bc65eb1f063d8b5fbdcf4bfd50c0f
-
SHA256
3031897cf889210dccb36904e71aad0e44019d64fee9e1abb50ea388a194f286
-
SHA512
e6934068e4c5c5ac760bed2e02ba9dab5404e5c6f53cbaadffa5468a7a88c7aa4ca697140e554029024eb7d54e6392a2d3e26c6532c48458053c632c5922e399
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-