Overview

overview

10

Static

static

4f5bf39c67...38.exe

windows7-x64

10

4f5bf39c67...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f5bf39c67ddb9f7fad0d0fc409e0938.exe

  • Size

    488KB

  • Sample

    221027-lml1dsbgek

  • MD5

    4f5bf39c67ddb9f7fad0d0fc409e0938

  • SHA1

    86f96267f7dd4deb95dca6b6b951ee9fede63788

  • SHA256

    f4d0518740e6b904a853dc465dc28b7d07b8960af83347dad891795fa36b1866

  • SHA512

    6ed64bf1a9daf12ed0923d3102357cea37016b151e30c012c2729438cbb181142115a50f4e7dc516b36b1f9bf899b3ff4feac1692617c0abba9bc1b24b950ee6

  • SSDEEP

    6144:vzJuoXyxgC7hTXQGzMWU4YtUgsAOuaVwKywfb9EsZk6lFFWHPewwbt973BFwpIcp:7JyxgC7ZXmsp3yw9E2yHy3PwfEef

Score
10/10
vidar1707spywarestealer

Malware Config

Extracted

Family

vidar

Version

55.2

Botnet

1707

C2

https://t.me/slivetalks

https://c.im/@xinibin420
Attributes
  • profile_id

    1707

Targets

    • Target

      4f5bf39c67ddb9f7fad0d0fc409e0938.exe

    • Size

      488KB

    • MD5

      4f5bf39c67ddb9f7fad0d0fc409e0938

    • SHA1

      86f96267f7dd4deb95dca6b6b951ee9fede63788

    • SHA256

      f4d0518740e6b904a853dc465dc28b7d07b8960af83347dad891795fa36b1866

    • SHA512

      6ed64bf1a9daf12ed0923d3102357cea37016b151e30c012c2729438cbb181142115a50f4e7dc516b36b1f9bf899b3ff4feac1692617c0abba9bc1b24b950ee6

    • SSDEEP

      6144:vzJuoXyxgC7hTXQGzMWU4YtUgsAOuaVwKywfb9EsZk6lFFWHPewwbt973BFwpIcp:7JyxgC7ZXmsp3yw9E2yHy3PwfEef

    Score
    10/10
    vidar1707spywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks