General
-
Target
f6cf6a83aff82ec967dde8839900098082c4abb964eec4dd569f8fcc7836c423
-
Size
583KB
-
Sample
220304-sxfdxsgggl
-
MD5
77e772dfa88f23bc7f605bbd90e19f66
-
SHA1
a49d3e5c72d8975a8233720eecd7ffcdd3225681
-
SHA256
f6cf6a83aff82ec967dde8839900098082c4abb964eec4dd569f8fcc7836c423
-
SHA512
ac8f5dfd06675f452d63ca80845de7adff5df189870a02b82ac711d93b652bee204eef19d15fed81fda66e5b6f7d7406c53999fe16e6b90684be07e98b84b2e7
Static task
static1
Behavioral task
behavioral1
Sample
f6cf6a83aff82ec967dde8839900098082c4abb964eec4dd569f8fcc7836c423.exe
Resource
win7-en-20211208
Malware Config
Extracted
vidar
25.1
237
http://cuyahogarave.com/
-
profile_id
237
Targets
-
-
Target
f6cf6a83aff82ec967dde8839900098082c4abb964eec4dd569f8fcc7836c423
-
Size
583KB
-
MD5
77e772dfa88f23bc7f605bbd90e19f66
-
SHA1
a49d3e5c72d8975a8233720eecd7ffcdd3225681
-
SHA256
f6cf6a83aff82ec967dde8839900098082c4abb964eec4dd569f8fcc7836c423
-
SHA512
ac8f5dfd06675f452d63ca80845de7adff5df189870a02b82ac711d93b652bee204eef19d15fed81fda66e5b6f7d7406c53999fe16e6b90684be07e98b84b2e7
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-