General
-
Target
01ecb8e12553c49e1e31a7246653b6131289f22f44f0deb7097afb39ff46af9f
-
Size
3.6MB
-
Sample
220523-vwcyhsbgfj
-
MD5
697576793e02be59d60a0ba2a59bbc8d
-
SHA1
3d8e38dfb94cf336c4a31e03e4ccd8bc4983bae5
-
SHA256
01ecb8e12553c49e1e31a7246653b6131289f22f44f0deb7097afb39ff46af9f
-
SHA512
1f065f44a4be0ac4b41efd51e26d19dd56001ad9969d4191ff5f1d70059d77dcd21eb01d09b5bc27461e19545a90c877fce5222fe9aea40c38dc1347aab117ea
Static task
static1
Behavioral task
behavioral1
Sample
01ecb8e12553c49e1e31a7246653b6131289f22f44f0deb7097afb39ff46af9f.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
9.4
231
http://prohomedevelopers.com/
-
profile_id
231
Targets
-
-
Target
01ecb8e12553c49e1e31a7246653b6131289f22f44f0deb7097afb39ff46af9f
-
Size
3.6MB
-
MD5
697576793e02be59d60a0ba2a59bbc8d
-
SHA1
3d8e38dfb94cf336c4a31e03e4ccd8bc4983bae5
-
SHA256
01ecb8e12553c49e1e31a7246653b6131289f22f44f0deb7097afb39ff46af9f
-
SHA512
1f065f44a4be0ac4b41efd51e26d19dd56001ad9969d4191ff5f1d70059d77dcd21eb01d09b5bc27461e19545a90c877fce5222fe9aea40c38dc1347aab117ea
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-