vidar | setups[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

setups.exe
Size

389.1MB
MD5

c2e942fb09a439c3a2687e6b389c9251
SHA1

d5e1230a1c965da0a907557258da95e27bc8ec00
SHA256

8b277cc1f2ec679a58204383a4a88513878377f8cdee4a1e4a7edfb7e98527cc
SHA512

708a44c6cd745fdc8be6ff9478c66ac98e19d167bd8caea7551843211d0d2dc3e5fab1833f386787103a16dc756820c7019a85397beab6aebe53b25574e7fcee
SSDEEP

49152:Nmq0q3HQsPG0yyfyRA9XApRHNSgjIoQFSA:/z16Cqp7FqFSA

Score

10^/10

stealer themida 1281 vidar

Malware Config

Extracted

Family

vidar

Version

53.1

Botnet

1281

http://t.me/dvijkkkk

Attributes

profile_id
1281

Signatures

Vidar Stealer 1 IoCs
stealer

Processes:

resource yara_rule

sample family_vidar
Vidar family
vidar
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	family_vidar

resource	yara_rule
sample	themida

Files

setups.exe
.exe windows x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:31:e4:8d:08:06:5b:09:8f:84:e7:c5:10:33:60:74
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06-03-2020 00:00

Not After

15-03-2023 12:00

Subject

CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:5d:31:ed:6e:9a:37:e2:fb:4d:2c:77:91:04:d0:11:a4:e3:5f:ea:d0:34:49:6d:01:2e:9e:af:8a:46:46:39
Signer

Actual PE Digest

23:5d:31:ed:6e:9a:37:e2:fb:4d:2c:77:91:04:d0:11:a4:e3:5f:ea:d0:34:49:6d:01:2e:9e:af:8a:46:46:39

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

11-06-2022 13:36
Valid: true

Chain 1

CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

艾弗��
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vm_sec
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:31:e4:8d:08:06:5b:09:8f:84:e7:c5:10:33:60:74Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

23:5d:31:ed:6e:9a:37:e2:fb:4d:2c:77:91:04:d0:11:a4:e3:5f:ea:d0:34:49:6d:01:2e:9e:af:8a:46:46:39Signer

Signature Validations

Verification

11-06-2022 13:36 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 218KB - Virtual size: 217KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 7KB - Virtual size: 83KB

艾弗�� Size: 2KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.rsrc Size: 198KB - Virtual size: 198KB

.vm_sec Size: 96KB - Virtual size: 96KB

.idata Size: 512B - Virtual size: 4KB

.themida Size: 2.5MB - Virtual size: 2.5MB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:31:e4:8d:08:06:5b:09:8f:84:e7:c5:10:33:60:74
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

23:5d:31:ed:6e:9a:37:e2:fb:4d:2c:77:91:04:d0:11:a4:e3:5f:ea:d0:34:49:6d:01:2e:9e:af:8a:46:46:39
Signer

11-06-2022 13:36
Valid: true

.text
Size: 218KB - Virtual size: 217KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 7KB - Virtual size: 83KB

艾弗��
Size: 2KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 198KB - Virtual size: 198KB

.vm_sec
Size: 96KB - Virtual size: 96KB

.idata
Size: 512B - Virtual size: 4KB

.themida
Size: 2.5MB - Virtual size: 2.5MB