General

  • Target

    file.exe

  • Size

    327KB

  • Sample

    221107-r6ey3scce7

  • MD5

    583f633192f85aaa50b9f7ed7b169b39

  • SHA1

    a4cc6354ae632607535728b00d47359641fa445c

  • SHA256

    02384bb954f75596ee2caa74b7a9b2be6d4c39ae191d864b50725bc8f5245a41

  • SHA512

    309d81e72fbc8855fb6c90fdc2ce2cfb28d191e6300a8c2a98130eae8619da21eccd51dc40b33572af476beae835a9feb39de6a6e643283933ce7cb97e08e2b4

  • SSDEEP

    6144:7GILUGfOnDhxin5Y3PV9eMPucDkKnwsT/uEnIhSx1H:7vQGfUa5YfKvFKwsTV3

Malware Config

Extracted

Family

vidar

Version

55.6

Botnet

937

C2

https://ioc.exchange/@xiteb15011

https://t.me/tg_turgay

Attributes
  • profile_id

    937

Targets

    • Target

      file.exe

    • Size

      327KB

    • MD5

      583f633192f85aaa50b9f7ed7b169b39

    • SHA1

      a4cc6354ae632607535728b00d47359641fa445c

    • SHA256

      02384bb954f75596ee2caa74b7a9b2be6d4c39ae191d864b50725bc8f5245a41

    • SHA512

      309d81e72fbc8855fb6c90fdc2ce2cfb28d191e6300a8c2a98130eae8619da21eccd51dc40b33572af476beae835a9feb39de6a6e643283933ce7cb97e08e2b4

    • SSDEEP

      6144:7GILUGfOnDhxin5Y3PV9eMPucDkKnwsT/uEnIhSx1H:7vQGfUa5YfKvFKwsTV3

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks