General
-
Target
ytSetupEU.bin.zip
-
Size
4.2MB
-
Sample
220212-l4wwxscehq
-
MD5
3f0851e13b0ac6e6e4033647779f81ad
-
SHA1
b77be983da157c2f48ab2351ab28d1d2ba7e08f9
-
SHA256
221cbd514d9ce5faa1a710b79017c67488cd9fd91c1cf7806ebcd47517a874d8
-
SHA512
3baffe7c7fc918ee3d6020991dbe366207aba83da13ecbd09b9a7333c6905b7631d76c3994aeddc51e640674ff8afb392ff40278881d99c25ac32c1364d8998e
Malware Config
Extracted
vidar
10.3
231
http://trasolevelqvines.com/
-
profile_id
231
Targets
-
-
Target
ytSetupEU.exe
-
Size
4.3MB
-
MD5
9d3d0e705b4e4b8b2a694b89802c9f32
-
SHA1
f0ee20b66f07b71c5d29e859adb301e6c0daf5af
-
SHA256
8361e4858ff44de225a4e3bb6c23e739f494af295f7c94e9744af2d6dcf56321
-
SHA512
548a18686a7f1ef4a26e9cc0df6422f94c1e328d13fc7618511e1303eee8d688ddde0048441126b51e6028a434bc86fe90a0487655d7226196be653813ff68f2
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
autoit_exe
AutoIT scripts compiled to PE executables.
-