Overview

overview

10

Static

static

dbc0302e93...41.exe

windows7_x64

10

dbc0302e93...41.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbc0302e93bc96ba1b4f31b89bedd6296c2357031e4f7cab2cf92a7dbbea2c41

  • Size

    716KB

  • Sample

    220215-f82ebabcf8

  • MD5

    63f4b6eaa164b32ecca0e2aafa789cec

  • SHA1

    35e6ac15b1a7f15b3d105f3796dcb54c67170abb

  • SHA256

    dbc0302e93bc96ba1b4f31b89bedd6296c2357031e4f7cab2cf92a7dbbea2c41

  • SHA512

    28947763a80114af308ee51726b1072777260fd9766be0a2c6be8a7d1c78c29b5496e59a790ab897c9d6b13731b17bb5f6faebba546a538a96e319c87aa29fee

Score
10/10
vidar932stealer

Malware Config

Extracted

Family

vidar

Version

48.1

Botnet

932

C2

https://koyu.space/@rspich

Attributes
  • profile_id

    932

Targets

    • Target

      dbc0302e93bc96ba1b4f31b89bedd6296c2357031e4f7cab2cf92a7dbbea2c41

    • Size

      716KB

    • MD5

      63f4b6eaa164b32ecca0e2aafa789cec

    • SHA1

      35e6ac15b1a7f15b3d105f3796dcb54c67170abb

    • SHA256

      dbc0302e93bc96ba1b4f31b89bedd6296c2357031e4f7cab2cf92a7dbbea2c41

    • SHA512

      28947763a80114af308ee51726b1072777260fd9766be0a2c6be8a7d1c78c29b5496e59a790ab897c9d6b13731b17bb5f6faebba546a538a96e319c87aa29fee

    Score
    10/10
    vidar932stealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks