Overview

overview

10

Static

static

c0468d6d8f...85.exe

windows7_x64

10

c0468d6d8f...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985

  • Size

    688KB

  • Sample

    220215-g84p4sbgd9

  • MD5

    5716c79899c4b2f43e50fcf4e9eaefa0

  • SHA1

    9bbc2ae9dd7ac947fa87b6a905670764f717920f

  • SHA256

    c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985

  • SHA512

    d87126a3fa0949946149b0d84f03e3fc408a923d0a257e7418ec03fcb02da6dcd4fd8bacc557272c083f915142b970065c144876476f65c561a90a6aa6b4f9c2

Score
10/10
vidar937stealer

Malware Config

Extracted

Family

vidar

Version

48.1

Botnet

937

C2

https://koyu.space/@rspich

Attributes
  • profile_id

    937

Targets

    • Target

      c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985

    • Size

      688KB

    • MD5

      5716c79899c4b2f43e50fcf4e9eaefa0

    • SHA1

      9bbc2ae9dd7ac947fa87b6a905670764f717920f

    • SHA256

      c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985

    • SHA512

      d87126a3fa0949946149b0d84f03e3fc408a923d0a257e7418ec03fcb02da6dcd4fd8bacc557272c083f915142b970065c144876476f65c561a90a6aa6b4f9c2

    Score
    10/10
    vidar937stealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks