Overview

overview

10

Static

static

7

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    2.1MB

  • Sample

    221121-qsdcnafd21

  • MD5

    246a5bd21a525fa139ac2c67247d84d2

  • SHA1

    6891ff304fcb372ebbbe2f18918d8fc2b8733078

  • SHA256

    814e1797632ab2b56c316495975f8984f366a1a4f242d8c7f8eeab0358df63b7

  • SHA512

    d4b1472144286d65a0ae5741c5347e4a039a3f59b87504afa98bc9e5ecfe1ceecccf61e8e4fc445ea59c19c06c576838eaa53c99695614276af51a975df69346

  • SSDEEP

    49152:XEDKlSU0ZxZdz0p8EiUi7q+/zEGR/A/LoRVT1uhN9:rlnOZR5Zp/oiAD4XuN

Score
10/10
vidar1679evasionspywarestealerthemidatrojan

Malware Config

Extracted

Family

vidar

Version

55.7

Botnet

1679

C2

https://t.me/deadftx

https://www.tiktok.com/@user6068972597711
Attributes
  • profile_id

    1679

Targets

    • Target

      file.exe

    • Size

      2.1MB

    • MD5

      246a5bd21a525fa139ac2c67247d84d2

    • SHA1

      6891ff304fcb372ebbbe2f18918d8fc2b8733078

    • SHA256

      814e1797632ab2b56c316495975f8984f366a1a4f242d8c7f8eeab0358df63b7

    • SHA512

      d4b1472144286d65a0ae5741c5347e4a039a3f59b87504afa98bc9e5ecfe1ceecccf61e8e4fc445ea59c19c06c576838eaa53c99695614276af51a975df69346

    • SSDEEP

      49152:XEDKlSU0ZxZdz0p8EiUi7q+/zEGR/A/LoRVT1uhN9:rlnOZR5Zp/oiAD4XuN

    Score
    10/10
    vidar1679evasionspywarestealerthemidatrojan

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks