General
Target

2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe

Filesize

708KB

Completed

15-02-2022 14:59

Task

behavioral1

Score
10/10
MD5

9c18b1d03dfef684145efdaf64ef2c25

SHA1

8a038d5a59ec994afdb558658c5ee1f92d690288

SHA256

2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258

SHA512

defec70294504707ccc36317d5875e6462e1db0cb75b9bbd68595755aadac41daac416ab4a49abee6ef3a06a026e48d03fd8ff745d96500cb5674c70d751d04f

Malware Config

Extracted

Family

vidar

Version

48.6

Botnet

937

C2

https://mastodon.online/@valhalla

https://koyu.space/@valhalla

Attributes
profile_id
937
Signatures 2

Filter: none

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1552-58-0x0000000000220000-0x00000000002F5000-memory.dmpfamily_vidar
    behavioral1/memory/1552-59-0x0000000000400000-0x00000000004D8000-memory.dmpfamily_vidar
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe
    "C:\Users\Admin\AppData\Local\Temp\2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe"
    PID:1552
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1552-55-0x000000000221D000-0x000000000229A000-memory.dmp

                          • memory/1552-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

                          • memory/1552-57-0x000000000221D000-0x000000000229A000-memory.dmp

                          • memory/1552-58-0x0000000000220000-0x00000000002F5000-memory.dmp

                          • memory/1552-59-0x0000000000400000-0x00000000004D8000-memory.dmp