vidar

General

Target

Sharefolder2.exe
Size

748KB
Sample

211024-dmxswschc5
MD5

cb6f0a5bfc40395f58844714615459ae
SHA1

86a3888444fdbaa719fe721bd57834a7d6ce1b00
SHA256

03116e2c133a0b24e6e170e6050a2fb341cba851d6bad9df8c0efcaa1e4546f8
SHA512

fff949543a2f9865d426fc672d3f31be8932c819bcf854dcab7cf6ebc212b4d59e54bbb1de7268b13001d9a565542729c8ee641fa19ac56d4d1d73bde21c2f6f

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

915

C2

https://mas.to/@xeroxxx

Attributes

profile_id
915

Extracted

Family

vidar

Version

41.5

Botnet

1045

C2

https://mas.to/@xeroxxx

Attributes

profile_id
1045

Targets

- Target
  
  Sharefolder2.exe
- Size
  
  748KB
- MD5
  
  cb6f0a5bfc40395f58844714615459ae
- SHA1
  
  86a3888444fdbaa719fe721bd57834a7d6ce1b00
- SHA256
  
  03116e2c133a0b24e6e170e6050a2fb341cba851d6bad9df8c0efcaa1e4546f8
- SHA512
  
  fff949543a2f9865d426fc672d3f31be8932c819bcf854dcab7cf6ebc212b4d59e54bbb1de7268b13001d9a565542729c8ee641fa19ac56d4d1d73bde21c2f6f
Score

10^/10

evasion persistence vidar 1045 915 discovery spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2