General
-
Target
436b22bb2341d2d123c746da8ff4c1ed600bc8668baaa042cb50a3c5a220034c
-
Size
459KB
-
Sample
220707-2xstpafecp
-
MD5
4d9c6a50e3a296f4eccb450aa97ac34b
-
SHA1
e860fff60ac1bebae67463e335f9800c6460136f
-
SHA256
436b22bb2341d2d123c746da8ff4c1ed600bc8668baaa042cb50a3c5a220034c
-
SHA512
db32d40fa5de9b759ac13337d459666faec91512584e2182890e6aef45b190cb01aeedc94699cffe5b0b70e7b254f2b2d4e122c21d2636793ca7f506a1c80f60
Static task
static1
Behavioral task
behavioral1
Sample
436b22bb2341d2d123c746da8ff4c1ed600bc8668baaa042cb50a3c5a220034c.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
16.3
533
http://ybookfli.net/
-
profile_id
533
Targets
-
-
Target
436b22bb2341d2d123c746da8ff4c1ed600bc8668baaa042cb50a3c5a220034c
-
Size
459KB
-
MD5
4d9c6a50e3a296f4eccb450aa97ac34b
-
SHA1
e860fff60ac1bebae67463e335f9800c6460136f
-
SHA256
436b22bb2341d2d123c746da8ff4c1ed600bc8668baaa042cb50a3c5a220034c
-
SHA512
db32d40fa5de9b759ac13337d459666faec91512584e2182890e6aef45b190cb01aeedc94699cffe5b0b70e7b254f2b2d4e122c21d2636793ca7f506a1c80f60
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-