Overview

overview

10

Static

static

3c2acafef3...23.exe

windows7_x64

10

3c2acafef3...23.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3c2acafef30f0868587e5dfd2fe6f123.exe
  • Size 518KB
  • Sample210706-27ac6q2qvs
  • SHA256 d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76
  • MD5 SHA1 SHA512
Score
10/10
vidar313spywarestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 39.4

Botnet

  • 313

C2

  • https://sergeevih43.tumblr.com

Attributes
  • profile_id

    313

Targets

    • Target
      3c2acafef30f0868587e5dfd2fe6f123.exe
    • Size 518KB
    • SHA256 d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76
    • MD5 SHA1 SHA512
    Score
    10/10
    vidar313spywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Core1 .NET packer

      Detects packer/loader used by .NET malware.

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks