vidar | d6aa19e296877911b4fa7304d542938d1d20ccdabf8bc7eeed7adef0b46aa01d | Triage

Analysis

max time kernel
133s
max time network
137s
platform
windows7_x64
resource
win7-en-20211208
submitted
11-02-2022 23:48

Sharing

Report Analysis Logs

General

Target

d6aa19e296877911b4fa7304d542938d1d20ccdabf8bc7eeed7adef0b46aa01d.exe
Size

681KB
MD5

646b30e37c849bef88fbab49693396e7
SHA1

43e7cdceacc97a4eae7112ab7710a0698bd42d51
SHA256

d6aa19e296877911b4fa7304d542938d1d20ccdabf8bc7eeed7adef0b46aa01d
SHA512

f068d2cc226f570ec2e11f1b202d349aa488f14c70e566b31c7ca534024ad3d7f297e1a30e22e5faf407fdb89cc975c7e22e9ec578a0db927a9581512bb52893

Score

10^/10

vidar 937 stealer

Malware Config

Extracted

Family

vidar

Version

49

Botnet

937

C2

https://mstdn.social/@sergeev43

https://koyu.space/@sergeev45

Attributes

profile_id
937

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1308-56-0x0000000000A40000-0x0000000000B19000-memory.dmp	family_vidar
behavioral1/memory/1308-57-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar

C:\Users\Admin\AppData\Local\Temp\d6aa19e296877911b4fa7304d542938d1d20ccdabf8bc7eeed7adef0b46aa01d.exe
"C:\Users\Admin\AppData\Local\Temp\d6aa19e296877911b4fa7304d542938d1d20ccdabf8bc7eeed7adef0b46aa01d.exe"
1⤵
PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x00000000002D0000-0x000000000034C000-memory.dmp

Filesize
496KB

Download
memory/1308-56-0x0000000000A40000-0x0000000000B19000-memory.dmp

Filesize
868KB

Download
memory/1308-57-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download