General
-
Target
e8a534f94f68272791048bf43507140aaebd98774a57b287bb0c43b620b5165d
-
Size
761KB
-
Sample
220731-hjz63adcb5
-
MD5
ae92b171634d37a32975cbd96768274b
-
SHA1
c424fa7c30ee7d18b0dfe5217bc5550cb9b023a3
-
SHA256
e8a534f94f68272791048bf43507140aaebd98774a57b287bb0c43b620b5165d
-
SHA512
35b417523ce348d3798424985da9c61fa108d54f5482298948ba8d8bf40dd49ff795f1a67a36adc2736ec9a665ff69457ef3dfc260b89d5f1367fe53966c444a
Static task
static1
Behavioral task
behavioral1
Sample
e8a534f94f68272791048bf43507140aaebd98774a57b287bb0c43b620b5165d.exe
Resource
win7-20220715-en
Malware Config
Extracted
vidar
13.9
324
http://weimachel.net/
-
profile_id
324
Targets
-
-
Target
e8a534f94f68272791048bf43507140aaebd98774a57b287bb0c43b620b5165d
-
Size
761KB
-
MD5
ae92b171634d37a32975cbd96768274b
-
SHA1
c424fa7c30ee7d18b0dfe5217bc5550cb9b023a3
-
SHA256
e8a534f94f68272791048bf43507140aaebd98774a57b287bb0c43b620b5165d
-
SHA512
35b417523ce348d3798424985da9c61fa108d54f5482298948ba8d8bf40dd49ff795f1a67a36adc2736ec9a665ff69457ef3dfc260b89d5f1367fe53966c444a
-
Vidar Stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-