General
-
Target
eufive_20211111-201011
-
Size
763KB
-
Sample
211111-yqm33shbfj
-
MD5
21f71e9010772597781500edebb648ba
-
SHA1
2f372e27f0bc918c125748abaefbda132847d2cf
-
SHA256
d9aec37728d421adadb6784597496ec43a6c72bc0d3aceecaa07baa0f0cd9b1d
-
SHA512
81d19282df9a03bd4795b50f5b7d43a7f1bd6c1d13f81f254619abbec040e06a3fed52637a4c34bd74cc7fd492354bdc1d062cf30643fb81976f5875350fb811
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20211111-201011.exe
Resource
win7-en-20211014
Malware Config
Extracted
vidar
48.2
824
https://koyu.space/@qmashton
-
profile_id
824
Targets
-
-
Target
eufive_20211111-201011
-
Size
763KB
-
MD5
21f71e9010772597781500edebb648ba
-
SHA1
2f372e27f0bc918c125748abaefbda132847d2cf
-
SHA256
d9aec37728d421adadb6784597496ec43a6c72bc0d3aceecaa07baa0f0cd9b1d
-
SHA512
81d19282df9a03bd4795b50f5b7d43a7f1bd6c1d13f81f254619abbec040e06a3fed52637a4c34bd74cc7fd492354bdc1d062cf30643fb81976f5875350fb811
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-