Overview

overview

10

Static

static

e95e733bac...db.exe

windows7_x64

10

e95e733bac...db.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e95e733bac49684b353f36eab6699cf2381fe70a24780b5f9c4652aedde765db

  • Size

    724KB

  • Sample

    220215-frq71sbaf7

  • MD5

    30553fda3c478ad34cd131e8c737fcd5

  • SHA1

    eca040530afda239c342f7d436d51ebbebe2fb2d

  • SHA256

    e95e733bac49684b353f36eab6699cf2381fe70a24780b5f9c4652aedde765db

  • SHA512

    13ed294b8ea980304b6fb6354d5e6b50e2188f213b68613c8bf03c7d791544d31c4b90aabec6fdf558e4a43d47627d3e920929a7f3b854102939b30f162996c2

Score
10/10
vidar937stealer

Malware Config

Extracted

Family

vidar

Version

47.8

Botnet

937

C2

https://mas.to/@romashkin

Attributes
  • profile_id

    937

Targets

    • Target

      e95e733bac49684b353f36eab6699cf2381fe70a24780b5f9c4652aedde765db

    • Size

      724KB

    • MD5

      30553fda3c478ad34cd131e8c737fcd5

    • SHA1

      eca040530afda239c342f7d436d51ebbebe2fb2d

    • SHA256

      e95e733bac49684b353f36eab6699cf2381fe70a24780b5f9c4652aedde765db

    • SHA512

      13ed294b8ea980304b6fb6354d5e6b50e2188f213b68613c8bf03c7d791544d31c4b90aabec6fdf558e4a43d47627d3e920929a7f3b854102939b30f162996c2

    Score
    10/10
    vidar937stealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks