General
-
Target
b8da124e50d54e5b84d5823a8736638bbec4becff75527531891c250cbfcb0a7
-
Size
621KB
-
Sample
220725-en3afaebel
-
MD5
62c8ca06d22f8f7e6a530bfa5e273a49
-
SHA1
b2d1fe28c792ffebd2566270fb2e70e48ad43491
-
SHA256
b8da124e50d54e5b84d5823a8736638bbec4becff75527531891c250cbfcb0a7
-
SHA512
cbfa69c84b0f318ba6eac13df48bd3d3a8e776b7f6dbb74f74a4bcd40baa516777d8b3f4db7a542b539dc80991e71aac78ef277e6c1e784418bd25cb47daba12
Static task
static1
Behavioral task
behavioral1
Sample
b8da124e50d54e5b84d5823a8736638bbec4becff75527531891c250cbfcb0a7.exe
Resource
win7-20220718-en
Malware Config
Extracted
vidar
9.4
83
http://prohomedevelopers.com/
-
profile_id
83
Targets
-
-
Target
b8da124e50d54e5b84d5823a8736638bbec4becff75527531891c250cbfcb0a7
-
Size
621KB
-
MD5
62c8ca06d22f8f7e6a530bfa5e273a49
-
SHA1
b2d1fe28c792ffebd2566270fb2e70e48ad43491
-
SHA256
b8da124e50d54e5b84d5823a8736638bbec4becff75527531891c250cbfcb0a7
-
SHA512
cbfa69c84b0f318ba6eac13df48bd3d3a8e776b7f6dbb74f74a4bcd40baa516777d8b3f4db7a542b539dc80991e71aac78ef277e6c1e784418bd25cb47daba12
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-