vidar | 07ee7b94d6bea6279df2347f129ff9c5e519b18d1d6c1c3f9b78551d0a4879a1 | Triage

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-05-2022 07:17

Sharing

Report Analysis Logs

General

Target

07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe
Size

547KB
MD5

2b037a2c06313308444a96ac4941128e
SHA1

48de4839a33d637e15e0b8d5cfbc96c9efa5320d
SHA256

07ee7b94d6bea6279df2347f129ff9c5e519b18d1d6c1c3f9b78551d0a4879a1
SHA512

31eee92db685543091f7053e47307176bb490bce4a0e1f0519d545d8b3209d5021e52102d660125fa61b40756a46c746d4ee680692545aaec87c6e98c07587b5

Score

10^/10

vidar 237 stealer suricata

Malware Config

Extracted

Family

vidar

Version

24.1

Botnet

237

C2

http://selousgame.com/

Attributes

profile_id
237

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Vidar Stealer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4444-131-0x0000000000D80000-0x0000000000E09000-memory.dmp	family_vidar
behavioral2/memory/4444-132-0x0000000000400000-0x00000000008FC000-memory.dmp	family_vidar

C:\Users\Admin\AppData\Local\Temp\07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe
"C:\Users\Admin\AppData\Local\Temp\07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe"
1⤵
PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4444-130-0x0000000000A97000-0x0000000000AED000-memory.dmp

Filesize
344KB

Download
memory/4444-131-0x0000000000D80000-0x0000000000E09000-memory.dmp

Filesize
548KB

Download
memory/4444-132-0x0000000000400000-0x00000000008FC000-memory.dmp

Filesize
5.0MB

Download