General

  • Target

    8565ffd9927d710197ffc41000835124.exe

  • Size

    296KB

  • Sample

    220925-hs782aehgm

  • MD5

    8565ffd9927d710197ffc41000835124

  • SHA1

    7c908987eca2c76ee44cca8f3730c3e3936e0d0c

  • SHA256

    a2f6d565d70e1c41bcfdd6c763f237dda3252d2c207012f77f58d3c5dc6a5a4a

  • SHA512

    62d94d2d06c53006826e6a7574ab62f5c4cf8c84a96f00474fc2b184368f1e4f7b4027236d8325c615f508734bfc8d52f690f6ea9bc17375726489260d69a5f5

  • SSDEEP

    6144:6LJiaeLZgzdlhATiXyy9EszjfGYncgXz5VONnDPLTtj:69iaeLqXyyXX7nd1V2nvTt

Malware Config

Extracted

Family

vidar

Version

54.6

Botnet

1684

C2

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes
  • profile_id

    1684

Targets

    • Target

      8565ffd9927d710197ffc41000835124.exe

    • Size

      296KB

    • MD5

      8565ffd9927d710197ffc41000835124

    • SHA1

      7c908987eca2c76ee44cca8f3730c3e3936e0d0c

    • SHA256

      a2f6d565d70e1c41bcfdd6c763f237dda3252d2c207012f77f58d3c5dc6a5a4a

    • SHA512

      62d94d2d06c53006826e6a7574ab62f5c4cf8c84a96f00474fc2b184368f1e4f7b4027236d8325c615f508734bfc8d52f690f6ea9bc17375726489260d69a5f5

    • SSDEEP

      6144:6LJiaeLZgzdlhATiXyy9EszjfGYncgXz5VONnDPLTtj:69iaeLqXyyXX7nd1V2nvTt

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks