General
-
Target
dfb0c2dacbc1b10873514103605925d9684bba9d01cfd6de0320b083eb36e220
-
Size
619KB
-
Sample
211217-hzh8gseabk
-
MD5
7ef99cc93634f90b3f782d361cb10a75
-
SHA1
9b0b565d41ded08ae67064f3a7e7ce9601e4e843
-
SHA256
dfb0c2dacbc1b10873514103605925d9684bba9d01cfd6de0320b083eb36e220
-
SHA512
a2473419c64198f30086b78f9d74d0b03c34fc06a615755d1093de8287b5542c29440a0b9c94147892488cc8a35eef80d87353c728b3d383a329a9f5eb7b7703
Static task
static1
Malware Config
Extracted
vidar
49.1
903
https://noc.social/@sergeev46
https://c.im/@sergeev47
-
profile_id
903
Targets
-
-
Target
dfb0c2dacbc1b10873514103605925d9684bba9d01cfd6de0320b083eb36e220
-
Size
619KB
-
MD5
7ef99cc93634f90b3f782d361cb10a75
-
SHA1
9b0b565d41ded08ae67064f3a7e7ce9601e4e843
-
SHA256
dfb0c2dacbc1b10873514103605925d9684bba9d01cfd6de0320b083eb36e220
-
SHA512
a2473419c64198f30086b78f9d74d0b03c34fc06a615755d1093de8287b5542c29440a0b9c94147892488cc8a35eef80d87353c728b3d383a329a9f5eb7b7703
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-