General
-
Target
151b35e77d77973a3386732ec0b8f56e0ec08f63f052c0333fdf0f9185f4baa3
-
Size
733KB
-
Sample
220106-vpqwssbhak
-
MD5
5cfdfbbd928e7f75439ab753a3ed477e
-
SHA1
79e59a3c5585e8512e7dbed0f427c3112c453e44
-
SHA256
151b35e77d77973a3386732ec0b8f56e0ec08f63f052c0333fdf0f9185f4baa3
-
SHA512
dfaea78777aa23f840fcd4cb000ae1f9b04e6d6f471711e2e059c1286e0e2e49ad56f0a81edf0a9f31173be60098e1efdf5df24c3094710a617f122974bff4f1
Static task
static1
Malware Config
Extracted
vidar
49.5
937
https://qoto.org/@banda4ker
https://c.im/@banda3ker
-
profile_id
937
Targets
-
-
Target
151b35e77d77973a3386732ec0b8f56e0ec08f63f052c0333fdf0f9185f4baa3
-
Size
733KB
-
MD5
5cfdfbbd928e7f75439ab753a3ed477e
-
SHA1
79e59a3c5585e8512e7dbed0f427c3112c453e44
-
SHA256
151b35e77d77973a3386732ec0b8f56e0ec08f63f052c0333fdf0f9185f4baa3
-
SHA512
dfaea78777aa23f840fcd4cb000ae1f9b04e6d6f471711e2e059c1286e0e2e49ad56f0a81edf0a9f31173be60098e1efdf5df24c3094710a617f122974bff4f1
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-