General

  • Target

    5438fc4e7c66a72b2b75b248d970b5ef.exe

  • Size

    1.2MB

  • Sample

    211031-sf6vjsgag7

  • MD5

    5438fc4e7c66a72b2b75b248d970b5ef

  • SHA1

    9f489ac261c84fca71a5c9ca42459ff029ca895d

  • SHA256

    03953078a89e2efb12217ac6df2584d0c8d5ce0190daca67d85910e24f273383

  • SHA512

    6d8f569d3c906ddf650226c3d404a5a095eff926b23e3598fff10a9ea241f6b7103949df3e6483b36272b17e4ee7a90d8435d0daf686b910720af13756ae9061

Malware Config

Extracted

Family

vidar

Version

41.6

Botnet

921

C2

https://mas.to/@lilocc

Attributes
  • profile_id

    921

Targets

    • Target

      5438fc4e7c66a72b2b75b248d970b5ef.exe

    • Size

      1.2MB

    • MD5

      5438fc4e7c66a72b2b75b248d970b5ef

    • SHA1

      9f489ac261c84fca71a5c9ca42459ff029ca895d

    • SHA256

      03953078a89e2efb12217ac6df2584d0c8d5ce0190daca67d85910e24f273383

    • SHA512

      6d8f569d3c906ddf650226c3d404a5a095eff926b23e3598fff10a9ea241f6b7103949df3e6483b36272b17e4ee7a90d8435d0daf686b910720af13756ae9061

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Tasks