General
-
Target
12e3d47757b20af09b9fdb893a776c3b3745ab6fdea10795ec1104c57f2c66bd
-
Size
548KB
-
Sample
220521-nwr9wahchl
-
MD5
7414b72cacf3583e2afa049021829698
-
SHA1
1aa8fcdfdbe7e09ea62e1b75604ea591f56d517b
-
SHA256
12e3d47757b20af09b9fdb893a776c3b3745ab6fdea10795ec1104c57f2c66bd
-
SHA512
1365934bd0910311baa09e1fff835c2573e85cef98d0256acf9abbf3dd79184c1725d87d59d421c97e7806dd5ab087267b588f7b28c14ac2d7fd3ea2de1b3939
Behavioral task
behavioral1
Sample
12e3d47757b20af09b9fdb893a776c3b3745ab6fdea10795ec1104c57f2c66bd.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
30.7
664
http://korikanelolsa.tech/
-
profile_id
664
Targets
-
-
Target
12e3d47757b20af09b9fdb893a776c3b3745ab6fdea10795ec1104c57f2c66bd
-
Size
548KB
-
MD5
7414b72cacf3583e2afa049021829698
-
SHA1
1aa8fcdfdbe7e09ea62e1b75604ea591f56d517b
-
SHA256
12e3d47757b20af09b9fdb893a776c3b3745ab6fdea10795ec1104c57f2c66bd
-
SHA512
1365934bd0910311baa09e1fff835c2573e85cef98d0256acf9abbf3dd79184c1725d87d59d421c97e7806dd5ab087267b588f7b28c14ac2d7fd3ea2de1b3939
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-