General

  • Target

    67e0f94ca1fc7682d56aaada7a53b5c9346b9e36745f0f8d2b5ea3bcf3abff40

  • Size

    239KB

  • Sample

    220617-c91ydsabdj

  • MD5

    6322fb06f4d1b355a0801e02ec00156c

  • SHA1

    753c9e4a97568ca9a56f1e5876c746686d26852b

  • SHA256

    67e0f94ca1fc7682d56aaada7a53b5c9346b9e36745f0f8d2b5ea3bcf3abff40

  • SHA512

    89fa646024c943c8432595d213d4e083ad48950d8e805c6a31c8236a5c970f940331ba9096587f23c3a4fae61ef9e9e513e4ba4aabe4594b87e4252f57c21255

Malware Config

Extracted

Family

vidar

Version

52.6

Botnet

1415

C2

https://t.me/tg_dailylessons

https://busshi.moe/@olegf9844xx

Attributes
  • profile_id

    1415

Extracted

Family

recordbreaker

C2

http://138.197.179.146/

Extracted

Family

redline

Botnet

mario

C2

193.106.191.129:80

Attributes
  • auth_value

    8fb912f79eac650a3e3f25f46f070f5d

Extracted

Family

redline

Botnet

USAeuTEST

C2

193.106.191.246:23196

Attributes
  • auth_value

    7dbf5ba6d421c1b0e8ce8d5867af4537

Targets

    • Target

      67e0f94ca1fc7682d56aaada7a53b5c9346b9e36745f0f8d2b5ea3bcf3abff40

    • Size

      239KB

    • MD5

      6322fb06f4d1b355a0801e02ec00156c

    • SHA1

      753c9e4a97568ca9a56f1e5876c746686d26852b

    • SHA256

      67e0f94ca1fc7682d56aaada7a53b5c9346b9e36745f0f8d2b5ea3bcf3abff40

    • SHA512

      89fa646024c943c8432595d213d4e083ad48950d8e805c6a31c8236a5c970f940331ba9096587f23c3a4fae61ef9e9e513e4ba4aabe4594b87e4252f57c21255

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

    • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

4
T1005

Email Collection

1
T1114

Tasks