vidar

General

Target
99fe658c432bd480bbb6cf895fb0edd3.exe
Size 1.6MB
Sample210927-vtp53ahehm
SHA256 144ff14c185d4af1806915a328610083bd86e81eda86fde7df1071a7dd7ef3c0
MD5 99fe658c432bd480bbb6cf895fb0edd3
SHA1 8eb28ec6b6ef2c474ad4e171ec828ab5e4643327
SHA512 e4aa527e3224ed5f57397cc0dbe15abb5ab87e4bc0ea0a09f57b6461f25df8dab67ff1c9c18cd90762e909113916e8c3d09bea4527aa55688aea1994cc569833
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  99fe658c432bd480bbb6cf895fb0edd3.exe
- Size 1.6MB
- SHA256 144ff14c185d4af1806915a328610083bd86e81eda86fde7df1071a7dd7ef3c0
- MD5 99fe658c432bd480bbb6cf895fb0edd3
- SHA1 8eb28ec6b6ef2c474ad4e171ec828ab5e4643327
- SHA512 e4aa527e3224ed5f57397cc0dbe15abb5ab87e4bc0ea0a09f57b6461f25df8dab67ff1c9c18cd90762e909113916e8c3d09bea4527aa55688aea1994cc569833
- MD5 SHA1 SHA512
Score

10^/10

vidar discovery spyware stealer suricata
- Suspicious use of NtCreateProcessExOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2