General
-
Target
193b3023b3665a5054f4fc7ff11c6c80f2f1569e8b1f66e8df0f2ca404d0cc72
-
Size
653KB
-
Sample
220608-ryt32abfan
-
MD5
58f06cad4c804366565de62ec9fde918
-
SHA1
aaa10511e2244e3cd1432fe402f4a0f2d457c7b7
-
SHA256
193b3023b3665a5054f4fc7ff11c6c80f2f1569e8b1f66e8df0f2ca404d0cc72
-
SHA512
0502e5bd59d5b13c0b4dd552eed9d082aa724d78bc784ac56e7a18fa5d8446e689187f8f17fd807d6332723a01b9e3889a63697c194f817914c97568b7445214
Static task
static1
Behavioral task
behavioral1
Sample
193b3023b3665a5054f4fc7ff11c6c80f2f1569e8b1f66e8df0f2ca404d0cc72.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
16.7
543
http://bokrosiiit.com/
-
profile_id
543
Targets
-
-
Target
193b3023b3665a5054f4fc7ff11c6c80f2f1569e8b1f66e8df0f2ca404d0cc72
-
Size
653KB
-
MD5
58f06cad4c804366565de62ec9fde918
-
SHA1
aaa10511e2244e3cd1432fe402f4a0f2d457c7b7
-
SHA256
193b3023b3665a5054f4fc7ff11c6c80f2f1569e8b1f66e8df0f2ca404d0cc72
-
SHA512
0502e5bd59d5b13c0b4dd552eed9d082aa724d78bc784ac56e7a18fa5d8446e689187f8f17fd807d6332723a01b9e3889a63697c194f817914c97568b7445214
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-