General

  • Target

    57994709.exe

  • Size

    661KB

  • Sample

    220323-e9fnkafcf5

  • MD5

    b8fb898ec2cab9c10329175a89ca4a79

  • SHA1

    b51d1d227b347e7230732175165af6a8357579c4

  • SHA256

    8860ea573d5feae4a267aaa8cb8bf8c47f9c2c50e18ab3fc73d785afc89516cc

  • SHA512

    b0d00ee5d9297e8690fbb8566f8f3c0e47cd04534ea50aacabdbfef3cfb09c853a78db2a8ba06125f5416265cb8b2f5d1585109e950e66fd0b71ba2310789f1d

Malware Config

Extracted

Family

vidar

Version

50.7

Botnet

565

C2

https://ruhr.social/@sam9al

https://koyu.space/@samsa2l

Attributes
  • profile_id

    565

Targets

    • Target

      57994709.exe

    • Size

      661KB

    • MD5

      b8fb898ec2cab9c10329175a89ca4a79

    • SHA1

      b51d1d227b347e7230732175165af6a8357579c4

    • SHA256

      8860ea573d5feae4a267aaa8cb8bf8c47f9c2c50e18ab3fc73d785afc89516cc

    • SHA512

      b0d00ee5d9297e8690fbb8566f8f3c0e47cd04534ea50aacabdbfef3cfb09c853a78db2a8ba06125f5416265cb8b2f5d1585109e950e66fd0b71ba2310789f1d

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks