vidar | a28dd9f9e5e5b9cd4ed4678f272ae95b[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a28dd9f9e5e5b9cd4ed4678f272ae95b.exe
Size

301KB
MD5

a28dd9f9e5e5b9cd4ed4678f272ae95b
SHA1

8baf92898954d076879daf50bcd2b895ecd15f83
SHA256

503f345095e5aa479b922a79aa479394a7ecedc9eba9d396a2a82c4649a479d1
SHA512

a20b9661804f8b787434d70c7beccddef9a013bd76cab31f94e7da1162b8ed764e195d626e3ae7522e5f4581c169cd34ae190eb60f2b370859d2994f5ab7e310
SSDEEP

6144:eseUsm5KWQFn3X5KhXfFsVWAylCMiL4t/xedj4OlWzfosa:eseDV3X5KhXfFs0lILa/xel4OlWzgv

Score

10^/10

stealer 1332 vidar

Malware Config

Extracted

Family

vidar

Version

Botnet

1332

https://t.me/hollandracing

https://busshi.moe/@ronxik321

Attributes

profile_id
1332

Signatures

Vidar Stealer 1 IoCs
stealer

Processes:

resource yara_rule

sample family_vidar
Vidar family
vidar

resource	yara_rule
sample	family_vidar

Files

a28dd9f9e5e5b9cd4ed4678f272ae95b.exe
.exe windows x86

daf766c710ab43c33f43ee5bbe293518

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
VirtualAlloc
LoadLibraryA
lstrcmpiW
LocalAlloc
FreeLibrary
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
WideCharToMultiByte
LocalFree
CreateFileA
SetFilePointer
SystemTimeToFileTime
SetFileTime
WriteFile
GetFileAttributesA
ReadFile
CreateDirectoryA
GetCurrentDirectoryA
CloseHandle
LocalFileTimeToFileTime
GetFileSize
FindFirstFileW
lstrlenA
GetDriveTypeA
lstrcatA
lstrcmpW
SetCurrentDirectoryA
FindFirstFileA
GetLogicalDriveStringsA
GetLastError
CopyFileA
FindClose
FindNextFileA
lstrcatW
CreateMutexA
FindNextFileW
DeleteFileW
GetCurrentProcessId
GetSystemTime
lstrcpyW
DeleteFileA
CreateThread
CopyFileW
Process32First
OpenProcess
TerminateProcess
Sleep
GetFileSizeEx
Process32Next
GetPrivateProfileSectionNamesA
CreateToolhelp32Snapshot
lstrcpyA
GetComputerNameA
GetUserDefaultLocaleName
GlobalMemoryStatus
GetLocaleInfoA
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
IsWow64Process
GetSystemInfo
GetModuleHandleA
GetTickCount
GetFileAttributesW
CreateFileW
MultiByteToWideChar
UnmapViewOfFile
GetLocalTime
GetFileInformationByHandle
VirtualAllocExNuma
VirtualFree
GetCurrentProcess
WriteConsoleW
SetEndOfFile
CompareStringW
SetStdHandle
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetEnvironmentVariableA
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentThreadId
FileTimeToSystemTime
ExitProcess
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
HeapCreate
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError

shell32

ShellExecuteA
SHGetFolderPathA
SHFileOperationA
ShellExecuteExA

shlwapi

ord155
PathMatchSpecA
PathMatchSpecW

gdiplus

GdipGetImageEncodersSize
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncoders
GdipSaveImageToFile
GdipCloneImage
GdiplusStartup

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

daf766c710ab43c33f43ee5bbe293518

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

shlwapi

gdiplus

Sections

.text Size: 219KB - Virtual size: 218KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 7KB - Virtual size: 17KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 219KB - Virtual size: 218KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 7KB - Virtual size: 17KB

.reloc
Size: 16KB - Virtual size: 16KB