General
-
Target
0dc1bd902343c88fc8490bf5102be9a73d3331c9b27a45e561601b72acf6a748
-
Size
430KB
-
Sample
220503-sg3vaahhe3
-
MD5
2ed774844ba68a2cdaf9cc954d746a75
-
SHA1
26c2263a33066b774809a1dc7b099785553bee53
-
SHA256
0dc1bd902343c88fc8490bf5102be9a73d3331c9b27a45e561601b72acf6a748
-
SHA512
10f9cef701cfaebd788fca0f9d538c78ca09c8f25b2cee4a23af14c8ce2cebdb72107591f57d77bcb6b116832b9995c18d2901417d52a46f2873920804d8ab03
Static task
static1
Behavioral task
behavioral1
Sample
0dc1bd902343c88fc8490bf5102be9a73d3331c9b27a45e561601b72acf6a748.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
33.3
706
http://thecoldday.com/
-
profile_id
706
Targets
-
-
Target
0dc1bd902343c88fc8490bf5102be9a73d3331c9b27a45e561601b72acf6a748
-
Size
430KB
-
MD5
2ed774844ba68a2cdaf9cc954d746a75
-
SHA1
26c2263a33066b774809a1dc7b099785553bee53
-
SHA256
0dc1bd902343c88fc8490bf5102be9a73d3331c9b27a45e561601b72acf6a748
-
SHA512
10f9cef701cfaebd788fca0f9d538c78ca09c8f25b2cee4a23af14c8ce2cebdb72107591f57d77bcb6b116832b9995c18d2901417d52a46f2873920804d8ab03
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-