General

  • Target

    file.exe

  • Size

    349KB

  • Sample

    221029-mqjj4sddck

  • MD5

    05fa747612349b8a1cc5d73614203358

  • SHA1

    d03b722da8d712fbea79d4a2dc42102523516453

  • SHA256

    ae2e20a71116e5ac09e9f6add32482938da054e4d6d122499eaaca5fd566c3d1

  • SHA512

    68147cff08325e634f89815eb98ff6055b3fbdf6da1c8ae6400303eaa8108b328e2482f137259f1fdb0b36c9d081f535d8fd4fb896cc69b025341fe9668b74a4

  • SSDEEP

    6144:i1BiYLCCjjzjxFEyRnXlL15T/eQ6mDZstl:qBt2Cn/7rX5r6EZstl

Malware Config

Extracted

Family

vidar

Version

55.3

Botnet

937

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes
  • profile_id

    937

Targets

    • Target

      file.exe

    • Size

      349KB

    • MD5

      05fa747612349b8a1cc5d73614203358

    • SHA1

      d03b722da8d712fbea79d4a2dc42102523516453

    • SHA256

      ae2e20a71116e5ac09e9f6add32482938da054e4d6d122499eaaca5fd566c3d1

    • SHA512

      68147cff08325e634f89815eb98ff6055b3fbdf6da1c8ae6400303eaa8108b328e2482f137259f1fdb0b36c9d081f535d8fd4fb896cc69b025341fe9668b74a4

    • SSDEEP

      6144:i1BiYLCCjjzjxFEyRnXlL15T/eQ6mDZstl:qBt2Cn/7rX5r6EZstl

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks