Overview

overview

10

Static

static

271c8cd98e...fa.exe

windows7_x64

10

271c8cd98e...fa.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    271c8cd98ea973ac6f624d19208659fa.exe

  • Size

    770KB

  • Sample

    211010-ny2akafghm

  • MD5

    271c8cd98ea973ac6f624d19208659fa

  • SHA1

    23f8fe53a722a3684dd81e652ce1612940041423

  • SHA256

    039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1

  • SHA512

    df185d1934b12c6dc748caf83caec78d56a82067eb4f55912a7bd9953d44e58707396c8dc4812f770fcd2ec2fbf809c0dea0f77fb89f8d7e0353802a981a62ee

Score
10/10
vidar1008discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

1008

C2

https://mas.to/@serg4325

Attributes
  • profile_id

    1008

Targets

    • Target

      271c8cd98ea973ac6f624d19208659fa.exe

    • Size

      770KB

    • MD5

      271c8cd98ea973ac6f624d19208659fa

    • SHA1

      23f8fe53a722a3684dd81e652ce1612940041423

    • SHA256

      039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1

    • SHA512

      df185d1934b12c6dc748caf83caec78d56a82067eb4f55912a7bd9953d44e58707396c8dc4812f770fcd2ec2fbf809c0dea0f77fb89f8d7e0353802a981a62ee

    Score
    10/10
    vidar1008stealerdiscoveryspyware

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks