vidar | ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4

Sharing

Copy URL Twitter E-mail

General

Target
ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4
Size 556KB
Sample220524-c83etsgccl
SHA256 ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4
MD5 73342bdc5cd080f1c7ff67b114c22ed2
SHA1 a614eb57cea7d07a0eca397c25be2e0a81c88ecb
SHA512 93a4a88a2b981cae22e17024c91dade065567ca250f1ca527d92c05011230ad3929b86ea40dd8e839e8939a8d9a21bd8c7f380f54f87adae1a6b0288c27dc21b
SSDEEP 12288:JJjwsORzaDSssIiAmIMMfeu9Qu9fxl3uyTSrlWLX3/n:3jvOdyxliQGu9Rdx8yTSrlWLP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

Botnet

http://bastionprofi.ug/

Attributes

profile_id
122

Signatures

Masslogger family
masslogger

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar

Vidar family
vidar

Vidar log file 1 IoCs

Detects a log file produced by Vidar.

resource	yara_rule
sample	vidar_log_file

File Explorer

ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4

.exe 556KB

ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4

IMPHASH b4c442a653085d78e85b963e4db4fdf8
SHA256 ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4
MD5 73342bdc5cd080f1c7ff67b114c22ed2
SHA1 a614eb57cea7d07a0eca397c25be2e0a81c88ecb
SHA512 93a4a88a2b981cae22e17024c91dade065567ca250f1ca527d92c05011230ad3929b86ea40dd8e839e8939a8d9a21bd8c7f380f54f87adae1a6b0288c27dc21b
SSDEEP 12288:JJjwsORzaDSssIiAmIMMfeu9Qu9fxl3uyTSrlWLX3/n:3jvOdyxliQGu9Rdx8yTSrlWLP
MD5 SHA1 SHA512 SSDEEP

windows x86

Vidar Stealer

stealer
Vidar log file

Detects a log file produced by Vidar.

Minor OS version

Major OS version

Entry point

381754

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA GetCurrentProcessId SetCurrentDirectoryA CreateDirectoryA GetLastError CreateMutexA MultiByteToWideChar ReadFile GetFileSize GetVersionExA Process32Next Process32First CreateToolhelp32Snapshot TerminateProcess OpenProcess GetProcAddress LoadLibraryA FreeLibrary GetPrivateProfileSectionNamesA GetFileAttributesW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AreFileApisANSI SetFilePointer SetEndOfFile FlushFileBuffers UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetFileAttributesExW LoadLibraryW QueryPerformanceCounter GetTickCount GetSystemTime GetSystemTimeAsFileTime UnmapViewOfFile GetTempPathA GetTempPathW Sleep FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileW GetSystemInfo MapViewOfFile CreateFileMappingA GetComputerNameA IsWow64Process GetCurrentProcess GlobalMemoryStatus GetModuleHandleA GetUserDefaultLocaleName TzSpecificLocalTimeToSystemTime GetTimeZoneInformation GetLocaleInfoA GetFileSizeEx FileTimeToSystemTime GetFileInformationByHandle SystemTimeToFileTime GetLocalTime SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW GetStringTypeW GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetLogicalDriveStringsA GetDriveTypeA CreateDirectoryW CopyFileW lstrcpyW lstrcatW LocalFree FindFirstFileW lstrcmpW DeleteFileW FindNextFileW FindClose ExitProcess CreateFileA WriteFile CloseHandle LocalAlloc lstrlenA HeapFree GetProcessHeap SetEnvironmentVariableW GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP HeapAlloc WideCharToMultiByte FormatMessageA HeapCreate InitializeCriticalSectionAndSpinCount SetHandleCount HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId SetLastError GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetCPInfo LCMapStringW GetStartupInfoW HeapSetInformation GetCommandLineA HeapReAlloc GetModuleFileNameW GetStdHandle GetFileType WriteConsoleW RtlUnwind RaiseException DecodePointer InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer CompareStringW

user32

GetDesktopWindow GetSystemMetrics GetDC CharToOemA EnumDisplayDevicesW MessageBoxA GetKeyboardLayoutList wsprintfA ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateDCA GetDeviceCaps CreateCompatibleDC

advapi32

RegGetValueW RegOpenKeyExA RegQueryValueExA GetUserNameA GetCurrentHwProfileA RegOpenKeyExW RegEnumValueA RegCloseKey RegGetValueA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize

shlwapi

PathMatchSpecW

crypt32

CryptStringToBinaryA CryptUnprotectData

psapi

GetModuleFileNameExA GetModuleBaseNameA EnumProcessModules

wininet

HttpQueryInfoA InternetSetOptionA InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetOpenUrlA InternetOpenA HttpAddRequestHeadersA InternetSetFilePointer

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipSaveImageToFile GdipFree GdipAlloc GdipGetImageEncoders GdipDisposeImage