vidar | 100b0b5c3d507f5c5588dd0f920839f3b19bc10556adfbf6bdd19d9c540bfb47 | Triage

Analysis

max time kernel
181s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 02:06

Sharing

Report Analysis Logs

General

Target

3393497a21035095223eddda80b66b3c.exe
Size

665KB
MD5

3393497a21035095223eddda80b66b3c
SHA1

90aaef907a1c64bb9182676468c33caaefe66932
SHA256

100b0b5c3d507f5c5588dd0f920839f3b19bc10556adfbf6bdd19d9c540bfb47
SHA512

fcb12306f2c8393c53d87d16d7b172567bbfbce7eece0eac50315396867facbca22d5ba28baac1abf67ab1addaa4dfbe942e4a0e4703fe1551b9b372d60de4e1

Score

10^/10

vidar 565 stealer

Malware Config

Extracted

Family

vidar

Version

50.2

Botnet

565

C2

https://c.im/@killern3ax

https://qoto.org/@kill4rnix

Attributes

profile_id
565

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4532-131-0x0000000003850000-0x00000000038FC000-memory.dmp	family_vidar
behavioral2/memory/4532-132-0x0000000000400000-0x00000000004B0000-memory.dmp	family_vidar

C:\Users\Admin\AppData\Local\Temp\3393497a21035095223eddda80b66b3c.exe
"C:\Users\Admin\AppData\Local\Temp\3393497a21035095223eddda80b66b3c.exe"
1⤵
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4532-130-0x0000000003730000-0x000000000379B000-memory.dmp

Filesize
428KB

Download
memory/4532-131-0x0000000003850000-0x00000000038FC000-memory.dmp

Filesize
688KB

Download
memory/4532-132-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download