General

  • Target

    f334c8315512f9a3e7d30ef327e213b744a8e74994d5b304a19669ce97a9d509

  • Size

    592KB

  • Sample

    210926-2ety2afdd8

  • MD5

    c99ad4a0b0aad7f258f45ffbf360196d

  • SHA1

    10419bb90d8bc788178fc0bf5929ee405f57257e

  • SHA256

    f334c8315512f9a3e7d30ef327e213b744a8e74994d5b304a19669ce97a9d509

  • SHA512

    c0cf57bc3813a5a680face7f4e546dcf4e23ad150a99c426152a62ed08e96215aceb95b35a465d28d23ea5ef7f03e439aab3c8a8cdcd3891dbef210035bed777

Malware Config

Targets

    • Target

      f334c8315512f9a3e7d30ef327e213b744a8e74994d5b304a19669ce97a9d509

    • Size

      592KB

    • MD5

      c99ad4a0b0aad7f258f45ffbf360196d

    • SHA1

      10419bb90d8bc788178fc0bf5929ee405f57257e

    • SHA256

      f334c8315512f9a3e7d30ef327e213b744a8e74994d5b304a19669ce97a9d509

    • SHA512

      c0cf57bc3813a5a680face7f4e546dcf4e23ad150a99c426152a62ed08e96215aceb95b35a465d28d23ea5ef7f03e439aab3c8a8cdcd3891dbef210035bed777

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks