vidar | c4ba9a8a6a09263b324980cd9fcb50fae2c49aa2ebc47cdcce2d8b9f1c08b8c6 | Triage

Sharing

General

Target

c4ba9a8a6a09263b324980cd9fcb50fae2c49aa2ebc47cdcce2d8b9f1c08b8c6
Size

348KB
Sample

221028-k2v16sfegl
MD5

ee19a8acc6c6c1f3ae2d749682694e9a
SHA1

6ed9edee943c77413c52777bbf7a9311a972bec4
SHA256

c4ba9a8a6a09263b324980cd9fcb50fae2c49aa2ebc47cdcce2d8b9f1c08b8c6
SHA512

ae864b3771ced431468b8c03e1817b5a13fcdbf44854dff35eb19859bdbfef19150643eed649e74eb1dbaf41645dbb66304204c4293ef582fb357c20cd9ce85b
SSDEEP

6144:I9sH6LUn3szcdTjfu9oAZnXuaeqPOri5qPhAwcSJZ61yJ:I9sH6Y3sQdHW9BemqPJrJ

Score

10^/10

vidar 1707 discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

55.2

Botnet

1707

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes

profile_id
1707

Targets

- Target
  
  c4ba9a8a6a09263b324980cd9fcb50fae2c49aa2ebc47cdcce2d8b9f1c08b8c6
- Size
  
  348KB
- MD5
  
  ee19a8acc6c6c1f3ae2d749682694e9a
- SHA1
  
  6ed9edee943c77413c52777bbf7a9311a972bec4
- SHA256
  
  c4ba9a8a6a09263b324980cd9fcb50fae2c49aa2ebc47cdcce2d8b9f1c08b8c6
- SHA512
  
  ae864b3771ced431468b8c03e1817b5a13fcdbf44854dff35eb19859bdbfef19150643eed649e74eb1dbaf41645dbb66304204c4293ef582fb357c20cd9ce85b
- SSDEEP
  
  6144:I9sH6LUn3szcdTjfu9oAZnXuaeqPOri5qPhAwcSJZ61yJ:I9sH6Y3sQdHW9BemqPJrJ
Score

10^/10

vidar 1707 discovery spyware stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vidar1707discoveryspywarestealer