General
-
Target
eufive_20211112-194505
-
Size
628KB
-
Sample
211112-zj7dtabbgq
-
MD5
58284a1e5f641aec596b7f6bd655a51c
-
SHA1
f7bf2f2b16eca95cffeb64cb65aaa721e4ae2110
-
SHA256
bccb7fb59a7560b827c711c49ef69a1964706b53ea337260aab29fa53f123d50
-
SHA512
03f10619501dc4abcaf3c184df76e692b2c6d424f4db2275c395932516a8696827aa9b35a10a75267297c83c61f3aaa3cbed7291c0671fc56e3ae0bb87dc0f73
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20211112-194505.exe
Resource
win7-en-20211014
Malware Config
Extracted
vidar
48.3
824
-
profile_id
824
Targets
-
-
Target
eufive_20211112-194505
-
Size
628KB
-
MD5
58284a1e5f641aec596b7f6bd655a51c
-
SHA1
f7bf2f2b16eca95cffeb64cb65aaa721e4ae2110
-
SHA256
bccb7fb59a7560b827c711c49ef69a1964706b53ea337260aab29fa53f123d50
-
SHA512
03f10619501dc4abcaf3c184df76e692b2c6d424f4db2275c395932516a8696827aa9b35a10a75267297c83c61f3aaa3cbed7291c0671fc56e3ae0bb87dc0f73
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-