General

  • Target

    76d133dfbc76eb4735d52264930365e047ee8e5a6f9409b2ff5b8239eac8c007

  • Size

    593KB

  • Sample

    210927-bjgw6afeb5

  • MD5

    dd7256a3038dcd923b2cb6190dd8a2b8

  • SHA1

    8eedf2ad1e113465f5e8a52a6104d0cfe355ea1a

  • SHA256

    76d133dfbc76eb4735d52264930365e047ee8e5a6f9409b2ff5b8239eac8c007

  • SHA512

    d7fa4a7978e95745701b6cd305dfaeeb79af16e9c87d8e992304cf9736503428a95940265f577e95f98d635fb27fb984a2b6ac9ac1bba21d1ab38226b804bafa

Malware Config

Targets

    • Target

      76d133dfbc76eb4735d52264930365e047ee8e5a6f9409b2ff5b8239eac8c007

    • Size

      593KB

    • MD5

      dd7256a3038dcd923b2cb6190dd8a2b8

    • SHA1

      8eedf2ad1e113465f5e8a52a6104d0cfe355ea1a

    • SHA256

      76d133dfbc76eb4735d52264930365e047ee8e5a6f9409b2ff5b8239eac8c007

    • SHA512

      d7fa4a7978e95745701b6cd305dfaeeb79af16e9c87d8e992304cf9736503428a95940265f577e95f98d635fb27fb984a2b6ac9ac1bba21d1ab38226b804bafa

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks