General

  • Target

    eufive_20220223-141225

  • Size

    659KB

  • Sample

    220223-tjsb1aaga4

  • MD5

    7e86d9fc6b1cf08b82b692d893c05f36

  • SHA1

    5af950b7706ca6e7158d5ef486e20c5609fd14d0

  • SHA256

    5881b4236ed90b61498c527b0798c7d8591de80ff64bc9b9ec993ca712497b00

  • SHA512

    584ec431354cc901f184c4105338005f0d67f14d7c5cfe1935f0de556c60ddf4e0d9fa68e2a61b519c97cd73acbb02dbfdd6d48de20978eaed00a1efe85095a4

Malware Config

Extracted

Family

vidar

Version

50.3

Botnet

565

C2

https://mastodon.social/@kill5rnax

https://noc.social/@kill6nix

Attributes
  • profile_id

    565

Targets

    • Target

      eufive_20220223-141225

    • Size

      659KB

    • MD5

      7e86d9fc6b1cf08b82b692d893c05f36

    • SHA1

      5af950b7706ca6e7158d5ef486e20c5609fd14d0

    • SHA256

      5881b4236ed90b61498c527b0798c7d8591de80ff64bc9b9ec993ca712497b00

    • SHA512

      584ec431354cc901f184c4105338005f0d67f14d7c5cfe1935f0de556c60ddf4e0d9fa68e2a61b519c97cd73acbb02dbfdd6d48de20978eaed00a1efe85095a4

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks