vidar | 0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af

Sharing

Copy URL Twitter E-mail

General

Target
0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af
Size 556KB
Sample220604-w2ff9segcq
SHA256 0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af
MD5 28c30621685fb580d1e4bb8daf06baa8
SHA1 2adb5f9565e554e4dbf4414042113321f05ec6e2
SHA512 1e8d3dd4f2e1361709ea752cdaafa0cad5902edcab438d24c8f8d098267cfd885d7487a5b1016ce967b7fcacdbe7f4d072597af11d395f580b603fde2fe7e6f6
SSDEEP 12288:uTX9zl+g2Egi+SxNqlN2c+HFTRnk2FCVyC7aWtX3/k:INRXqYxNntHFNk2uyC7aWt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer 163 vidar masslogger

Malware Config

Extracted

Family

vidar

Version

Botnet

http://nasalietco.com/

Attributes

profile_id
163

Signatures

Masslogger family
masslogger

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar

Vidar family
vidar

Vidar log file 1 IoCs

Detects a log file produced by Vidar.

resource	yara_rule
sample	vidar_log_file

File Explorer

0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af

.exe 556KB

0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af

IMPHASH b4c442a653085d78e85b963e4db4fdf8
SHA256 0e982a02d754588d4ee99f30084b886b665ff04a1460d45c4fd410b04b10a8af
MD5 28c30621685fb580d1e4bb8daf06baa8
SHA1 2adb5f9565e554e4dbf4414042113321f05ec6e2
SHA512 1e8d3dd4f2e1361709ea752cdaafa0cad5902edcab438d24c8f8d098267cfd885d7487a5b1016ce967b7fcacdbe7f4d072597af11d395f580b603fde2fe7e6f6
SSDEEP 12288:uTX9zl+g2Egi+SxNqlN2c+HFTRnk2FCVyC7aWtX3/k:INRXqYxNntHFNk2uyC7aWt
MD5 SHA1 SHA512 SSDEEP

windows x86

Vidar Stealer

stealer
Vidar log file

Detects a log file produced by Vidar.

Minor OS version

Major OS version

Entry point

381626

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA GetCurrentProcessId SetCurrentDirectoryA CreateDirectoryA GetLastError CreateMutexA MultiByteToWideChar ReadFile GetFileSize GetVersionExA Process32Next Process32First CreateToolhelp32Snapshot TerminateProcess OpenProcess GetProcAddress LoadLibraryA FreeLibrary GetPrivateProfileSectionNamesA GetFileAttributesW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection EnterCriticalSection LeaveCriticalSection AreFileApisANSI SetFilePointer SetEndOfFile FlushFileBuffers UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetFileAttributesExW LoadLibraryW QueryPerformanceCounter GetTickCount GetSystemTime GetSystemTimeAsFileTime UnmapViewOfFile GetTempPathA GetTempPathW Sleep FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileW GetSystemInfo MapViewOfFile CreateFileMappingA GetComputerNameA IsWow64Process GetCurrentProcess GlobalMemoryStatus GetModuleHandleA GetUserDefaultLocaleName TzSpecificLocalTimeToSystemTime GetTimeZoneInformation GetLocaleInfoA GetFileSizeEx FileTimeToSystemTime GetFileInformationByHandle SystemTimeToFileTime GetLocalTime SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW GetStringTypeW GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetLogicalDriveStringsA GetDriveTypeA CreateDirectoryW CopyFileW lstrcpyW lstrcatW LocalFree FindFirstFileW lstrcmpW DeleteFileW FindNextFileW FindClose ExitProcess CreateFileA WriteFile CloseHandle LocalAlloc lstrlenA HeapFree GetProcessHeap SetEnvironmentVariableW GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP HeapAlloc WideCharToMultiByte FormatMessageA HeapCreate InitializeCriticalSectionAndSpinCount SetHandleCount HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId SetLastError GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetCPInfo LCMapStringW GetStartupInfoW HeapSetInformation GetCommandLineA HeapReAlloc GetModuleFileNameW GetStdHandle GetFileType WriteConsoleW RtlUnwind RaiseException DecodePointer InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer CompareStringW

user32

GetDesktopWindow GetSystemMetrics GetDC CharToOemA EnumDisplayDevicesW MessageBoxA GetKeyboardLayoutList wsprintfA ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateDCA GetDeviceCaps CreateCompatibleDC

advapi32

RegGetValueW RegOpenKeyExA RegQueryValueExA GetUserNameA GetCurrentHwProfileA RegOpenKeyExW RegEnumValueA RegCloseKey RegGetValueA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize

shlwapi

PathMatchSpecW

crypt32

CryptStringToBinaryA CryptUnprotectData

psapi

GetModuleFileNameExA GetModuleBaseNameA EnumProcessModules

wininet

HttpQueryInfoA InternetSetOptionA InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetOpenUrlA InternetOpenA HttpAddRequestHeadersA InternetSetFilePointer

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipSaveImageToFile GdipFree GdipAlloc GdipGetImageEncoders GdipDisposeImage