General
-
Target
6c5aec676bc03e89e0ff94b42303cabc0d4650029377b034c1de0a674e1ecc4e
-
Size
514KB
-
Sample
220520-fcalqadcck
-
MD5
61736cb3aaf29d5fec70484639b7d481
-
SHA1
2c3a24823fbc16ee532d55df34bd952971dfe33e
-
SHA256
6c5aec676bc03e89e0ff94b42303cabc0d4650029377b034c1de0a674e1ecc4e
-
SHA512
895e5dd02550cc97f8df53f1ee2a052174b7570ce5a8d1ffad9659b9fec04a20981454d9f565e970e7a79877140b0f9ec6a9771660842a422ea492429c205271
Static task
static1
Behavioral task
behavioral1
Sample
6c5aec676bc03e89e0ff94b42303cabc0d4650029377b034c1de0a674e1ecc4e.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
30
517
http://resilchird.com/
-
profile_id
517
Targets
-
-
Target
6c5aec676bc03e89e0ff94b42303cabc0d4650029377b034c1de0a674e1ecc4e
-
Size
514KB
-
MD5
61736cb3aaf29d5fec70484639b7d481
-
SHA1
2c3a24823fbc16ee532d55df34bd952971dfe33e
-
SHA256
6c5aec676bc03e89e0ff94b42303cabc0d4650029377b034c1de0a674e1ecc4e
-
SHA512
895e5dd02550cc97f8df53f1ee2a052174b7570ce5a8d1ffad9659b9fec04a20981454d9f565e970e7a79877140b0f9ec6a9771660842a422ea492429c205271
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-