Overview

overview

10

Static

static

MIX3h2_202...17.exe

windows7_x64

10

MIX3h2_202...17.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MIX3h2_20211028-131517

  • Size

    687KB

  • Sample

    211028-nkt94agbhr

  • MD5

    70edd52d751ee9abf214038981882d4c

  • SHA1

    0e80d1af1ededca0bf29ae954da0bc10efd4df55

  • SHA256

    112325ad769041fb8f69e8c8c97f849518b0651209669498cf8b9181f7162643

  • SHA512

    b3185a896a0c222e551fccb7408c2b9d5fce928527204e4b4e59522c00a58585eb8a87a9a2d54a86d657b7ec75746363a33c177d89a2b13dafefcfbdea1e3ceb

Score
10/10
vidar1026discoveryspywarestealersuricata

Malware Config

Extracted

Family

vidar

Version

41.6

Botnet

1026

C2

https://mas.to/@lilocc

Attributes
  • profile_id

    1026

Targets

    • Target

      MIX3h2_20211028-131517

    • Size

      687KB

    • MD5

      70edd52d751ee9abf214038981882d4c

    • SHA1

      0e80d1af1ededca0bf29ae954da0bc10efd4df55

    • SHA256

      112325ad769041fb8f69e8c8c97f849518b0651209669498cf8b9181f7162643

    • SHA512

      b3185a896a0c222e551fccb7408c2b9d5fce928527204e4b4e59522c00a58585eb8a87a9a2d54a86d657b7ec75746363a33c177d89a2b13dafefcfbdea1e3ceb

    Score
    10/10
    vidar1026discoveryspywarestealersuricata

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks