General
-
Target
d657a264f59c48375a868d8570ab3f1a.exe
-
Size
762KB
-
Sample
211222-nf1w3sgbbq
-
MD5
d657a264f59c48375a868d8570ab3f1a
-
SHA1
b7e4c0024d88834ddd6da01a93546a7b8bc58243
-
SHA256
4d400450149574e00a4c2d28429b1594dc52a5c08445471565606a4e80ad0488
-
SHA512
7cd069c76be9d501f1159d66f63db069be6a3824ee6656e379de76e978f44177c4b8b27b78b63819de57ac4128d75b62a39ed8efe632d345d4c2ea29bcc7bf0c
Static task
static1
Behavioral task
behavioral1
Sample
d657a264f59c48375a868d8570ab3f1a.exe
Resource
win7-en-20211208
Malware Config
Extracted
vidar
49.2
903
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
-
profile_id
903
Targets
-
-
Target
d657a264f59c48375a868d8570ab3f1a.exe
-
Size
762KB
-
MD5
d657a264f59c48375a868d8570ab3f1a
-
SHA1
b7e4c0024d88834ddd6da01a93546a7b8bc58243
-
SHA256
4d400450149574e00a4c2d28429b1594dc52a5c08445471565606a4e80ad0488
-
SHA512
7cd069c76be9d501f1159d66f63db069be6a3824ee6656e379de76e978f44177c4b8b27b78b63819de57ac4128d75b62a39ed8efe632d345d4c2ea29bcc7bf0c
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Vidar Stealer
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-