General
-
Target
49307107203f93e936323c91a83becac368fced1fce9f7a64cddfe1b0e4bdd2a
-
Size
734KB
-
Sample
211220-rc4qcaagc5
-
MD5
59d2f7975dceeacc85316a872dd416c3
-
SHA1
0a6e9d3327ba17e56d2ecca11c41be27b7bdcbc5
-
SHA256
49307107203f93e936323c91a83becac368fced1fce9f7a64cddfe1b0e4bdd2a
-
SHA512
d62ca33bcb6d7e8ecc533978ddc05a0416108786b296ebfd7d0a8fa8b4e3c48efc98e189af750036c3682b00d34546f51bccde3a25130d45997efeca29d5c802
Static task
static1
Behavioral task
behavioral1
Sample
49307107203f93e936323c91a83becac368fced1fce9f7a64cddfe1b0e4bdd2a.exe
Resource
win7-en-20211208
Malware Config
Extracted
vidar
49.1
937
https://noc.social/@sergeev46
https://c.im/@sergeev47
-
profile_id
937
Targets
-
-
Target
49307107203f93e936323c91a83becac368fced1fce9f7a64cddfe1b0e4bdd2a
-
Size
734KB
-
MD5
59d2f7975dceeacc85316a872dd416c3
-
SHA1
0a6e9d3327ba17e56d2ecca11c41be27b7bdcbc5
-
SHA256
49307107203f93e936323c91a83becac368fced1fce9f7a64cddfe1b0e4bdd2a
-
SHA512
d62ca33bcb6d7e8ecc533978ddc05a0416108786b296ebfd7d0a8fa8b4e3c48efc98e189af750036c3682b00d34546f51bccde3a25130d45997efeca29d5c802
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-