Overview

overview

10

Static

static

02303a665b...c9.exe

windows7_x64

10

02303a665b...c9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02303a665b7c5e81aaac34d2ff0f98c2da777f6e582603c526536da7d0dd12c9

  • Size

    484KB

  • Sample

    220324-xkjm2aheeq

  • MD5

    32eee49a755cb1b32bc9d713d8c7decd

  • SHA1

    5d597f46e31d88959062952eeee1f77ac4b4b100

  • SHA256

    02303a665b7c5e81aaac34d2ff0f98c2da777f6e582603c526536da7d0dd12c9

  • SHA512

    fbe31889ff8d31686e4f28112769b9f7ace526a1422be3d78424f29bc2ef3da11147baa8f85ec190892d5407fe340f373c1db81743c90cbd186315425ed49539

Score
10/10
vidar754spywarestealersuricata

Malware Config

Extracted

Family

vidar

Version

35

Botnet

754

C2

http://worstyear2020.com/

Attributes
  • profile_id

    754

Targets

    • Target

      02303a665b7c5e81aaac34d2ff0f98c2da777f6e582603c526536da7d0dd12c9

    • Size

      484KB

    • MD5

      32eee49a755cb1b32bc9d713d8c7decd

    • SHA1

      5d597f46e31d88959062952eeee1f77ac4b4b100

    • SHA256

      02303a665b7c5e81aaac34d2ff0f98c2da777f6e582603c526536da7d0dd12c9

    • SHA512

      fbe31889ff8d31686e4f28112769b9f7ace526a1422be3d78424f29bc2ef3da11147baa8f85ec190892d5407fe340f373c1db81743c90cbd186315425ed49539

    Score
    10/10
    vidar754spywarestealersuricata

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

      suricata

    • Vidar Stealer

      stealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks