General
-
Target
0a1cadddf9a7499907171a2c98e9a4caa02108eb299b67cfcd7e547a1325eca5
-
Size
656KB
-
Sample
220202-w525fabagr
-
MD5
3edf49c7068f5359d6f45e25818b3b60
-
SHA1
c35fb0266c9914f18dd7e0c2d767284585a96ed8
-
SHA256
0a1cadddf9a7499907171a2c98e9a4caa02108eb299b67cfcd7e547a1325eca5
-
SHA512
6b04c7e1b9f1ebc9a38a4e171b52820a43ddd85c832254ada00cd5b1fbf8587175cdcd24629ea7248f30628b05821fda0cc75e45ef354688372d45a0739af141
Malware Config
Extracted
vidar
50
937
https://mastodon.social/@prophef6
https://noc.social/@prophef5
-
profile_id
937
Targets
-
-
Target
0a1cadddf9a7499907171a2c98e9a4caa02108eb299b67cfcd7e547a1325eca5
-
Size
656KB
-
MD5
3edf49c7068f5359d6f45e25818b3b60
-
SHA1
c35fb0266c9914f18dd7e0c2d767284585a96ed8
-
SHA256
0a1cadddf9a7499907171a2c98e9a4caa02108eb299b67cfcd7e547a1325eca5
-
SHA512
6b04c7e1b9f1ebc9a38a4e171b52820a43ddd85c832254ada00cd5b1fbf8587175cdcd24629ea7248f30628b05821fda0cc75e45ef354688372d45a0739af141
Score10/10-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-