vidar | 098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab

Sharing

Copy URL Twitter E-mail

General

Target
098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab
Size 580KB
Sample220530-ws6xvsafcm
SHA256 098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab
MD5 3f109d730383f4a811fbf6a770a6a26b
SHA1 59942aa425874d94bffe6ebba6ae0fb429a726ae
SHA512 b5a807bf91ba9ebea701437698bfdb4787789fb3fc3e1f6419600552b4800b6994e58812cff93ce0980ac876bcb97880f8b18ce0b2a36acc36d929ac2abb5122
SSDEEP 12288:ZJjwsORzaDSssIiAmIMMfeu9Qu9fxl3uyTSrjW0X3/n:HjvOdyxliQGu9Rdx8yTSrjW0P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

Botnet

http://tepingost.ug/

Attributes

profile_id
194

Signatures

Masslogger family
masslogger

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar

Vidar family
vidar

Vidar log file 1 IoCs

Detects a log file produced by Vidar.

resource	yara_rule
sample	vidar_log_file

File Explorer

098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab

.exe 580KB

098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab

IMPHASH b4c442a653085d78e85b963e4db4fdf8
SHA256 098dd8e6626c9c46e734963c744e1f24ca208af78669c98d59be9bf74dfc5fab
MD5 3f109d730383f4a811fbf6a770a6a26b
SHA1 59942aa425874d94bffe6ebba6ae0fb429a726ae
SHA512 b5a807bf91ba9ebea701437698bfdb4787789fb3fc3e1f6419600552b4800b6994e58812cff93ce0980ac876bcb97880f8b18ce0b2a36acc36d929ac2abb5122
SSDEEP 12288:ZJjwsORzaDSssIiAmIMMfeu9Qu9fxl3uyTSrjW0X3/n:HjvOdyxliQGu9Rdx8yTSrjW0P
MD5 SHA1 SHA512 SSDEEP

windows x86

Vidar Stealer

stealer
Vidar log file

Detects a log file produced by Vidar.

Minor OS version

Major OS version

Entry point

381754

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA GetCurrentProcessId SetCurrentDirectoryA CreateDirectoryA GetLastError CreateMutexA MultiByteToWideChar ReadFile GetFileSize GetVersionExA Process32Next Process32First CreateToolhelp32Snapshot TerminateProcess OpenProcess GetProcAddress LoadLibraryA FreeLibrary GetPrivateProfileSectionNamesA GetFileAttributesW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AreFileApisANSI SetFilePointer SetEndOfFile FlushFileBuffers UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetFileAttributesExW LoadLibraryW QueryPerformanceCounter GetTickCount GetSystemTime GetSystemTimeAsFileTime UnmapViewOfFile GetTempPathA GetTempPathW Sleep FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileW GetSystemInfo MapViewOfFile CreateFileMappingA GetComputerNameA IsWow64Process GetCurrentProcess GlobalMemoryStatus GetModuleHandleA GetUserDefaultLocaleName TzSpecificLocalTimeToSystemTime GetTimeZoneInformation GetLocaleInfoA GetFileSizeEx FileTimeToSystemTime GetFileInformationByHandle SystemTimeToFileTime GetLocalTime SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW GetStringTypeW GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetLogicalDriveStringsA GetDriveTypeA CreateDirectoryW CopyFileW lstrcpyW lstrcatW LocalFree FindFirstFileW lstrcmpW DeleteFileW FindNextFileW FindClose ExitProcess CreateFileA WriteFile CloseHandle LocalAlloc lstrlenA HeapFree GetProcessHeap SetEnvironmentVariableW GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP HeapAlloc WideCharToMultiByte FormatMessageA HeapCreate InitializeCriticalSectionAndSpinCount SetHandleCount HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId SetLastError GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetCPInfo LCMapStringW GetStartupInfoW HeapSetInformation GetCommandLineA HeapReAlloc GetModuleFileNameW GetStdHandle GetFileType WriteConsoleW RtlUnwind RaiseException DecodePointer InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer CompareStringW

user32

GetDesktopWindow GetSystemMetrics GetDC CharToOemA EnumDisplayDevicesW MessageBoxA GetKeyboardLayoutList wsprintfA ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateDCA GetDeviceCaps CreateCompatibleDC

advapi32

RegGetValueW RegOpenKeyExA RegQueryValueExA GetUserNameA GetCurrentHwProfileA RegOpenKeyExW RegEnumValueA RegCloseKey RegGetValueA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize

shlwapi

PathMatchSpecW

crypt32

CryptStringToBinaryA CryptUnprotectData

psapi

GetModuleFileNameExA GetModuleBaseNameA EnumProcessModules

wininet

HttpQueryInfoA InternetSetOptionA InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetOpenUrlA InternetOpenA HttpAddRequestHeadersA InternetSetFilePointer

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipSaveImageToFile GdipFree GdipAlloc GdipGetImageEncoders GdipDisposeImage