General
- Target 8054fb018918f753e9a6b64f3da5b5c9.exe
- Size 713KB
- Sample200802-bpx9qdabla
- SHA256 620d15d15c20dcc0a6d2d79317160180cd92fc005fc7bbd864a8ba3be34f3635
Score
10/10
Malware Config
Targets
-
- Target 8054fb018918f753e9a6b64f3da5b5c9.exe
- Size 713KB
- SHA256 620d15d15c20dcc0a6d2d79317160180cd92fc005fc7bbd864a8ba3be34f3635
Score10/10Vidar
Vidar is an infostealer based on Arkei stealer.
ServiceHost packer
Detects ServiceHost packer used for .NET malware
Executes dropped EXE
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
JavaScript code in executable
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext