General
-
Target
tmp/1f3634d6-08ea-4a51-9ba5-852c5c8b05c4_VPN.exe
-
Size
769KB
-
Sample
211220-vkvdescahm
-
MD5
0ca4e7041810a02d31fd647cac83dffc
-
SHA1
79090f8b876477148ead0b3cb0b0eac26fc4f674
-
SHA256
3c0804293bdf92ce4a509b38100cc91ec7dff62b59cfc94a7bdb27713d5ec8f4
-
SHA512
e9256071641558b897001afe91b722606a965fb7bf0f881e50f02eec447ab98a98ba93ce0b998e355c1c455745bd3c624bfa16329d67d38ba59aaad764bddb2d
Static task
static1
Behavioral task
behavioral1
Sample
tmp/1f3634d6-08ea-4a51-9ba5-852c5c8b05c4_VPN.exe
Resource
win7-en-20211208
Malware Config
Extracted
vidar
49.2
903
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
-
profile_id
903
Targets
-
-
Target
tmp/1f3634d6-08ea-4a51-9ba5-852c5c8b05c4_VPN.exe
-
Size
769KB
-
MD5
0ca4e7041810a02d31fd647cac83dffc
-
SHA1
79090f8b876477148ead0b3cb0b0eac26fc4f674
-
SHA256
3c0804293bdf92ce4a509b38100cc91ec7dff62b59cfc94a7bdb27713d5ec8f4
-
SHA512
e9256071641558b897001afe91b722606a965fb7bf0f881e50f02eec447ab98a98ba93ce0b998e355c1c455745bd3c624bfa16329d67d38ba59aaad764bddb2d
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-