General
-
Target
46b44a3fc11e29a99e9c7390394f0cf8338fe4d76ade1fb91c37da3033deecdb
-
Size
3.6MB
-
Sample
220707-jtkpssfgep
-
MD5
f7d53aa01488466bb5a5d5960e6ab07a
-
SHA1
1ab04033bc587424042d5fd2d9eb676c198c8063
-
SHA256
46b44a3fc11e29a99e9c7390394f0cf8338fe4d76ade1fb91c37da3033deecdb
-
SHA512
85bc152116cec842958ff8c611840c6280a7db182f96f7c17e28cc4cce4cb08dbc8d59a8ffac67bbe6b6e8626ff887ce9ee8324498d030796f0c540e215ff096
Static task
static1
Behavioral task
behavioral1
Sample
46b44a3fc11e29a99e9c7390394f0cf8338fe4d76ade1fb91c37da3033deecdb.exe
Resource
win7-20220414-en
Malware Config
Extracted
vidar
9.4
231
http://prohomedevelopers.com/
-
profile_id
231
Targets
-
-
Target
46b44a3fc11e29a99e9c7390394f0cf8338fe4d76ade1fb91c37da3033deecdb
-
Size
3.6MB
-
MD5
f7d53aa01488466bb5a5d5960e6ab07a
-
SHA1
1ab04033bc587424042d5fd2d9eb676c198c8063
-
SHA256
46b44a3fc11e29a99e9c7390394f0cf8338fe4d76ade1fb91c37da3033deecdb
-
SHA512
85bc152116cec842958ff8c611840c6280a7db182f96f7c17e28cc4cce4cb08dbc8d59a8ffac67bbe6b6e8626ff887ce9ee8324498d030796f0c540e215ff096
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-