General
-
Target
eufive_20211115-140026
-
Size
679KB
-
Sample
211115-qalw3sfcel
-
MD5
6f1ebbdbb13dcadd51639e40fae169d1
-
SHA1
4c55d47baf88f8e0d614d211fda673e07e0a0925
-
SHA256
f06575885d17e359859ca78a576b6beee284a4cc8adf158569b4e9ba3bb2529f
-
SHA512
cec1c30148e1670c30aae8a7ab7ef276f1ace360a0659e4a539aa273e8f0100b03bcdbb13fb6dd16c8fc2798a50a85b7fe0c12fb9ee6bf42a1bfe6daf595fde8
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20211115-140026.exe
Resource
win7-en-20211014
Malware Config
Extracted
vidar
48.5
824
https://koyu.space/@tttaj
-
profile_id
824
Targets
-
-
Target
eufive_20211115-140026
-
Size
679KB
-
MD5
6f1ebbdbb13dcadd51639e40fae169d1
-
SHA1
4c55d47baf88f8e0d614d211fda673e07e0a0925
-
SHA256
f06575885d17e359859ca78a576b6beee284a4cc8adf158569b4e9ba3bb2529f
-
SHA512
cec1c30148e1670c30aae8a7ab7ef276f1ace360a0659e4a539aa273e8f0100b03bcdbb13fb6dd16c8fc2798a50a85b7fe0c12fb9ee6bf42a1bfe6daf595fde8
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-