vidar | 600cccc41326dd72d64618a05e7f3d8cbaa533af4975813e0803b84ee3dd11d2 | Triage

Analysis

max time kernel
142s
max time network
146s
platform
windows10_x64
resource
win10-20220223-en
submitted
03-03-2022 10:56

Sharing

Report Analysis Logs

General

Target

600cccc41326dd72d64618a05e7f3d8cbaa533af4975813e0803b84ee3dd11d2.exe
Size

723KB
MD5

79b43c60aa0d0a3ee3ab1dc0f035149f
SHA1

bcbfa5f42aa22ebc005719c44d7695760a3b37e9
SHA256

600cccc41326dd72d64618a05e7f3d8cbaa533af4975813e0803b84ee3dd11d2
SHA512

59c0b82a38255dcea9dca4ac8ecb1613367da1d6a45dc38407970992fd817e7f4de1e7f7a24f41d170804d9bb48ca0cba47c485cd3900e3d264d294726e74ada

Score

10^/10

vidar 565 stealer

Malware Config

Extracted

Family

vidar

Version

50.1

Botnet

565

C2

https://mastodon.online/@k1llerniax

https://koyu.space/@k1llerni2x

Attributes

profile_id
565

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3068-116-0x00000000047C0000-0x000000000486B000-memory.dmp	family_vidar
behavioral1/memory/3068-117-0x0000000000400000-0x00000000004B0000-memory.dmp	family_vidar

C:\Users\Admin\AppData\Local\Temp\600cccc41326dd72d64618a05e7f3d8cbaa533af4975813e0803b84ee3dd11d2.exe
"C:\Users\Admin\AppData\Local\Temp\600cccc41326dd72d64618a05e7f3d8cbaa533af4975813e0803b84ee3dd11d2.exe"
1⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-114-0x0000000002D3A000-0x0000000002DA5000-memory.dmp

Filesize
428KB

Download
memory/3068-115-0x0000000002D3A000-0x0000000002DA5000-memory.dmp

Filesize
428KB

Download
memory/3068-116-0x00000000047C0000-0x000000000486B000-memory.dmp

Filesize
684KB

Download
memory/3068-117-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download