General
-
Target
05724070d8c8d387b97c44e6fd9452f429d5babf13d3cb7e7affad9d995fc811
-
Size
3.6MB
-
Sample
220527-wgnbdafbb6
-
MD5
357fe7f6d6c38b0bf9c90d8a730f221b
-
SHA1
2c79680a3566fcede241fecd6e4a58e904b37bbe
-
SHA256
05724070d8c8d387b97c44e6fd9452f429d5babf13d3cb7e7affad9d995fc811
-
SHA512
5163875ffa53329f4d8c8d66db0d57a9c8e48949c015b30b25c832b3c755ac5b5dfb114f5fe2c058c90e97c389d4d4efc49cfef2e7d1803522d7db22c61b6b3b
Static task
static1
Behavioral task
behavioral1
Sample
05724070d8c8d387b97c44e6fd9452f429d5babf13d3cb7e7affad9d995fc811.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
10.7
231
http://mooreny.top/
-
profile_id
231
Targets
-
-
Target
05724070d8c8d387b97c44e6fd9452f429d5babf13d3cb7e7affad9d995fc811
-
Size
3.6MB
-
MD5
357fe7f6d6c38b0bf9c90d8a730f221b
-
SHA1
2c79680a3566fcede241fecd6e4a58e904b37bbe
-
SHA256
05724070d8c8d387b97c44e6fd9452f429d5babf13d3cb7e7affad9d995fc811
-
SHA512
5163875ffa53329f4d8c8d66db0d57a9c8e48949c015b30b25c832b3c755ac5b5dfb114f5fe2c058c90e97c389d4d4efc49cfef2e7d1803522d7db22c61b6b3b
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-