General

  • Target

    PolymerReload.exe

  • Size

    1.1MB

  • Sample

    241219-rg9r6avkck

  • MD5

    dc5dd4bb664c7a5b89adb87740f410aa

  • SHA1

    3530be832f3878c9227a1ca3166c35eba433bd76

  • SHA256

    d77648c1e78a6080111047b0fc08d40f6d4c7017171a57abb26fc442c5831e8e

  • SHA512

    e9e8813d7611c5df146f4cbc415369b288d045393ef3683fc413152aa40b3ecea34ff7cdcdf75e1f18b7a11ec48f647f65c466d154a1cbc722bf996398d8a194

  • SSDEEP

    24576:vGqopk4iczQjL7oadlnrzZFeOhRxMTZBHNyQtSB8xwskz0aXlgq6oVxRkyLGPiWt:+qhpczQjnoAhsCvMTZDIB8x4zp6wx9E

Malware Config

Targets

    • Target

      PolymerReload.exe

    • Size

      1.1MB

    • MD5

      dc5dd4bb664c7a5b89adb87740f410aa

    • SHA1

      3530be832f3878c9227a1ca3166c35eba433bd76

    • SHA256

      d77648c1e78a6080111047b0fc08d40f6d4c7017171a57abb26fc442c5831e8e

    • SHA512

      e9e8813d7611c5df146f4cbc415369b288d045393ef3683fc413152aa40b3ecea34ff7cdcdf75e1f18b7a11ec48f647f65c466d154a1cbc722bf996398d8a194

    • SSDEEP

      24576:vGqopk4iczQjL7oadlnrzZFeOhRxMTZBHNyQtSB8xwskz0aXlgq6oVxRkyLGPiWt:+qhpczQjnoAhsCvMTZDIB8x4zp6wx9E

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks