vidar

General

Target

ec29571409586834ae63e6b26ef8dc66bc7c0067f20627aa447a4fe7ce367bbf
Size

1.1MB
Sample

211220-rc2wraagc3
MD5

f6c66b83c9312dab57006ac49c8810ca
SHA1

627bd4e70ea9013eaff9c4db6dfc240d5a3acf16
SHA256

ec29571409586834ae63e6b26ef8dc66bc7c0067f20627aa447a4fe7ce367bbf
SHA512

f3617e0544c6188cfa1b1e2cd4f660c74b5ea905505ee2a8f2bac011c58cbe2c95537f42ad5486f15e0f26967cf470f11b9ecfa136325bccd489ba484c5d4e6b

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

49.1

Botnet

903

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes

profile_id
903

Targets

- Target
  
  ec29571409586834ae63e6b26ef8dc66bc7c0067f20627aa447a4fe7ce367bbf
- Size
  
  1.1MB
- MD5
  
  f6c66b83c9312dab57006ac49c8810ca
- SHA1
  
  627bd4e70ea9013eaff9c4db6dfc240d5a3acf16
- SHA256
  
  ec29571409586834ae63e6b26ef8dc66bc7c0067f20627aa447a4fe7ce367bbf
- SHA512
  
  f3617e0544c6188cfa1b1e2cd4f660c74b5ea905505ee2a8f2bac011c58cbe2c95537f42ad5486f15e0f26967cf470f11b9ecfa136325bccd489ba484c5d4e6b
Score

10^/10

vidar 903 discovery evasion spyware stealer trojan xmrig miner
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2