Analysis

  • max time kernel
    118s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    15-02-2022 13:09

General

  • Target

    59ea4f4c2e61bd019afde3df6437cdb0d2f35105e851dad2db4bbe47123c5032.exe

  • Size

    767KB

  • MD5

    c75d6765474f97b67689e397f5dbee8e

  • SHA1

    366205d0853d1fabb4047c88b5a080e674bb56c9

  • SHA256

    59ea4f4c2e61bd019afde3df6437cdb0d2f35105e851dad2db4bbe47123c5032

  • SHA512

    a74878081eb2feeadaa1ff0ae50fc896be7bc75e1748a64cf22a499aa61dc17495f7459c1cb7af820241e2404b4bd4ecc2bcdea7dffa2c28ce6485be2bef2261

Score
10/10

Malware Config

Extracted

Family

vidar

Version

48.6

Botnet

937

C2

https://mastodon.online/@valhalla

https://koyu.space/@valhalla

Attributes
  • profile_id

    937

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59ea4f4c2e61bd019afde3df6437cdb0d2f35105e851dad2db4bbe47123c5032.exe
    "C:\Users\Admin\AppData\Local\Temp\59ea4f4c2e61bd019afde3df6437cdb0d2f35105e851dad2db4bbe47123c5032.exe"
    1⤵
      PID:1672

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1672-55-0x0000000002C58000-0x0000000002CD5000-memory.dmp
      Filesize

      500KB

    • memory/1672-56-0x0000000075801000-0x0000000075803000-memory.dmp
      Filesize

      8KB

    • memory/1672-57-0x0000000002C58000-0x0000000002CD5000-memory.dmp
      Filesize

      500KB

    • memory/1672-58-0x0000000002D40000-0x0000000002E15000-memory.dmp
      Filesize

      852KB

    • memory/1672-59-0x0000000000400000-0x00000000004D8000-memory.dmp
      Filesize

      864KB