General
-
Target
3dbe4ac636009db48dd8a59bcfb36f4746da80b55603a7395a04c3c297d99454
-
Size
3.7MB
-
Sample
220701-r1fnesgdgj
-
MD5
bb42a11790611d99f931f88aa57f127b
-
SHA1
11e858ad7051205d8e2701b17f30fed1a462c772
-
SHA256
3dbe4ac636009db48dd8a59bcfb36f4746da80b55603a7395a04c3c297d99454
-
SHA512
7607591ffd5aae818327bcd942ad61bff650fe252376675d0baacbc9d0bddaa0357a127efd4e674d1013e7f5987b91b14f5e9a08d9ad743726a24409a6628777
Static task
static1
Behavioral task
behavioral1
Sample
3dbe4ac636009db48dd8a59bcfb36f4746da80b55603a7395a04c3c297d99454.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
10.6
231
http://coinchangerapi.com/
-
profile_id
231
Targets
-
-
Target
3dbe4ac636009db48dd8a59bcfb36f4746da80b55603a7395a04c3c297d99454
-
Size
3.7MB
-
MD5
bb42a11790611d99f931f88aa57f127b
-
SHA1
11e858ad7051205d8e2701b17f30fed1a462c772
-
SHA256
3dbe4ac636009db48dd8a59bcfb36f4746da80b55603a7395a04c3c297d99454
-
SHA512
7607591ffd5aae818327bcd942ad61bff650fe252376675d0baacbc9d0bddaa0357a127efd4e674d1013e7f5987b91b14f5e9a08d9ad743726a24409a6628777
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-