vidar | a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943 | Triage

Sharing

General

Target

a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943
Size

348KB
Sample

221028-qb831agbar
MD5

4cdcc096dfe2a3e05d34108713d2b689
SHA1

997dbb38811b46fd62e24e7d30d42f20560a5eb6
SHA256

a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943
SHA512

c5de6fe89cff0eb3fe2b8239a78373ba96e2440341193e8a8ac05fa8b4c753a0b0bad04c59ddc5b23909f66a84a5f86a41f2620aa020c6e8d7af99c0d43d49d3
SSDEEP

6144:nE/HTLTM6+jqYAUPTUZMI9q/SfBvELeatN22FeBdMZ0apzqcg:nE/HTs62qgP7IgS58LP22FAyVp+cg

Score

10^/10

vidar 1707 discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

55.2

Botnet

1707

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes

profile_id
1707

Targets

- Target
  
  a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943
- Size
  
  348KB
- MD5
  
  4cdcc096dfe2a3e05d34108713d2b689
- SHA1
  
  997dbb38811b46fd62e24e7d30d42f20560a5eb6
- SHA256
  
  a5a283967a61f5b1a787d072c5946244eac4c3b52165af01a7a099eaa58b0943
- SHA512
  
  c5de6fe89cff0eb3fe2b8239a78373ba96e2440341193e8a8ac05fa8b4c753a0b0bad04c59ddc5b23909f66a84a5f86a41f2620aa020c6e8d7af99c0d43d49d3
- SSDEEP
  
  6144:nE/HTLTM6+jqYAUPTUZMI9q/SfBvELeatN22FeBdMZ0apzqcg:nE/HTs62qgP7IgS58LP22FAyVp+cg
Score

10^/10

vidar 1707 discovery spyware stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vidar1707discoveryspywarestealer