Analysis

  • max time kernel
    135s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    11-02-2022 02:15

General

  • Target

    f62b55cabf15fa05867c107993417fcff2c75f6562675aa745e8b387c82b454e.exe

  • Size

    782KB

  • MD5

    1459eb752aa14cfe63e4fe91ac4c6156

  • SHA1

    ae17251c35269b05cfc235ab14cf92447fc44956

  • SHA256

    f62b55cabf15fa05867c107993417fcff2c75f6562675aa745e8b387c82b454e

  • SHA512

    f512a3533624644025d2a996ae0af05d1f39867c78e0a1981c42017e66889a739e783db1867366b72f59ca6881b1f8fe28079e765d972d78aac7610399895f82

Score
10/10

Malware Config

Extracted

Family

vidar

Version

49.4

Botnet

937

C2

https://mastodon.online/@banda1ker

https://koyu.space/@banda2ker

Attributes
  • profile_id

    937

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f62b55cabf15fa05867c107993417fcff2c75f6562675aa745e8b387c82b454e.exe
    "C:\Users\Admin\AppData\Local\Temp\f62b55cabf15fa05867c107993417fcff2c75f6562675aa745e8b387c82b454e.exe"
    1⤵
      PID:1972

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1972-55-0x0000000000D78000-0x0000000000DF5000-memory.dmp
      Filesize

      500KB

    • memory/1972-56-0x0000000074B21000-0x0000000074B23000-memory.dmp
      Filesize

      8KB

    • memory/1972-57-0x0000000000D78000-0x0000000000DF5000-memory.dmp
      Filesize

      500KB

    • memory/1972-58-0x0000000000E60000-0x0000000000F36000-memory.dmp
      Filesize

      856KB

    • memory/1972-59-0x0000000000400000-0x00000000004D9000-memory.dmp
      Filesize

      868KB