vidar

General

Target

41CCF2991FAF22D76A6D0F1BC576676C.exe
Size

530KB
Sample

210610-n8636pf7vn
MD5

41ccf2991faf22d76a6d0f1bc576676c
SHA1

33a81d32c114e65434f2213ef78d78674d23c1dd
SHA256

20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c
SHA512

f955b48e761116ed2b18ed899bbe201f8327c08ad0f911852be0688d16b37798eba3202a1e89cec5ad0015fdbee9c8a3f387fe1ac6a37d136ed5b2b21f992699

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

39.3

Botnet

915

C2

https://bandakere.tumblr.com

Attributes

profile_id
915

Targets

- Target
  
  41CCF2991FAF22D76A6D0F1BC576676C.exe
- Size
  
  530KB
- MD5
  
  41ccf2991faf22d76a6d0f1bc576676c
- SHA1
  
  33a81d32c114e65434f2213ef78d78674d23c1dd
- SHA256
  
  20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c
- SHA512
  
  f955b48e761116ed2b18ed899bbe201f8327c08ad0f911852be0688d16b37798eba3202a1e89cec5ad0015fdbee9c8a3f387fe1ac6a37d136ed5b2b21f992699
Score

10^/10

vidar 915 discovery evasion persistence spyware stealer trojan upx vmprotect
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2