vidar

General

Target
9fcf0f5b99f398b9e6b6afaa25c60917.exe
Size 577KB
Sample210923-p6ebfaecfq
SHA256 ed2ca82131cad5380e978d4c2d489e09f247463021b80cda9241bff82c10fb86
MD5 9fcf0f5b99f398b9e6b6afaa25c60917
SHA1 720faa2bf8de76f8e92161b792f0a99eeeb63883
SHA512 e9995cd9c5c3f694a9eb895de2840cdaecfd29681f2ca1616f9860fa2aabbbfdc1e678a3e54b69215c4ab6fdea8235a70773aa63d9e17d1c11647ae872bbb534
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  9fcf0f5b99f398b9e6b6afaa25c60917.exe
- Size 577KB
- SHA256 ed2ca82131cad5380e978d4c2d489e09f247463021b80cda9241bff82c10fb86
- MD5 9fcf0f5b99f398b9e6b6afaa25c60917
- SHA1 720faa2bf8de76f8e92161b792f0a99eeeb63883
- SHA512 e9995cd9c5c3f694a9eb895de2840cdaecfd29681f2ca1616f9860fa2aabbbfdc1e678a3e54b69215c4ab6fdea8235a70773aa63d9e17d1c11647ae872bbb534
- MD5 SHA1 SHA512
Score

10^/10

vidar discovery spyware stealer suricata
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2