vidar | 07ee7b94d6bea6279df2347f129ff9c5e519b18d1d6c1c3f9b78551d0a4879a1 | Triage

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 07:17

Sharing

Report Analysis Logs

General

Target

07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe
Size

547KB
MD5

2b037a2c06313308444a96ac4941128e
SHA1

48de4839a33d637e15e0b8d5cfbc96c9efa5320d
SHA256

07ee7b94d6bea6279df2347f129ff9c5e519b18d1d6c1c3f9b78551d0a4879a1
SHA512

31eee92db685543091f7053e47307176bb490bce4a0e1f0519d545d8b3209d5021e52102d660125fa61b40756a46c746d4ee680692545aaec87c6e98c07587b5

Score

10^/10

vidar 237 stealer suricata

Malware Config

Extracted

Family

vidar

Version

24.1

Botnet

237

C2

http://selousgame.com/

Attributes

profile_id
237

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Vidar Stealer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1528-56-0x00000000009E0000-0x0000000000A69000-memory.dmp	family_vidar
behavioral1/memory/1528-57-0x0000000000400000-0x00000000008FC000-memory.dmp	family_vidar

C:\Users\Admin\AppData\Local\Temp\07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe
"C:\Users\Admin\AppData\Local\Temp\07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe"
1⤵
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-54-0x0000000075391000-0x0000000075393000-memory.dmp

Filesize
8KB

Download
memory/1528-55-0x00000000002CA000-0x0000000000320000-memory.dmp

Filesize
344KB

Download
memory/1528-56-0x00000000009E0000-0x0000000000A69000-memory.dmp

Filesize
548KB

Download
memory/1528-57-0x0000000000400000-0x00000000008FC000-memory.dmp

Filesize
5.0MB

Download