General

  • Target

    file.exe

  • Size

    297KB

  • Sample

    221123-mbcs1sgh4y

  • MD5

    5f855f6a65f0bea8015a479933b182be

  • SHA1

    8ddf05bc2452ca32c2ac133f65e8dd6ea66a8827

  • SHA256

    db701c4c2b8a1a5f336b3039ac0e643a8e5105941d413f7fbbe85f3764ee8278

  • SHA512

    ada5a135f52304bef20966e460fa1efb79c2d4cd7c3ffaeae7fdbc1d7d7faf3f53dba843c36987b6ee78caa5c8ee494431e5f455dd47f2cf648897de8bb46705

  • SSDEEP

    6144:BswXLN+7xBy/WtAXFLRuuMl7PCi9A56sHh7Lhu:BswX47xNtAXpRuuMlrCi9gG

Malware Config

Extracted

Family

vidar

Version

55.8

Botnet

937

C2

https://t.me/headshotsonly

https://steamcommunity.com/profiles/76561199436777531

Attributes
  • profile_id

    937

Targets

    • Target

      file.exe

    • Size

      297KB

    • MD5

      5f855f6a65f0bea8015a479933b182be

    • SHA1

      8ddf05bc2452ca32c2ac133f65e8dd6ea66a8827

    • SHA256

      db701c4c2b8a1a5f336b3039ac0e643a8e5105941d413f7fbbe85f3764ee8278

    • SHA512

      ada5a135f52304bef20966e460fa1efb79c2d4cd7c3ffaeae7fdbc1d7d7faf3f53dba843c36987b6ee78caa5c8ee494431e5f455dd47f2cf648897de8bb46705

    • SSDEEP

      6144:BswXLN+7xBy/WtAXFLRuuMl7PCi9A56sHh7Lhu:BswX47xNtAXpRuuMlrCi9gG

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks