vidar | 0e90f08e676a99510ce1c883000ed2e5aff8a9f58d9c1339a5091739a48aee7d | Triage

Sharing

General

Target

SetupApp_x64_n.zip
Size

4.1MB
Sample

221125-k7yn9aba5w
MD5

31e2a0ba330f195a4a9fd83fe01cb0aa
SHA1

2aca2605f1e9dca9b55e9875412f37707fb5507a
SHA256

0e90f08e676a99510ce1c883000ed2e5aff8a9f58d9c1339a5091739a48aee7d
SHA512

0ea263e77455aeb881d86b207c830607a3c9351cf1b1fcba966fd88a12d2f6e706ef760f149dfbed40ef03be52afaf4361f6dbb4ac8fb4387024cf4231e453da
SSDEEP

98304:nOWkgn9wJ3JU9Gy2IHDuUpFqIdzzWyBkVsU7n:nOWkUa5U9L2IHDlCyIsU7n

Score

10^/10

vidar 1774 persistence stealer

Malware Config

Extracted

Family

vidar

Version

55.8

Botnet

1774

C2

https://t.me/ghhdkddfkrt_fdklvv

Attributes

profile_id
1774

Targets

- Target
  
  SetupApp_x64_n/SetupApp_x64_n.exe
- Size
  
  677.7MB
- MD5
  
  117a3234e87cd472561267bacb11055f
- SHA1
  
  20a56c73135aae92da2dbad4c1e9114c2552d222
- SHA256
  
  6cea51aed1fbfa511b7259b59a51eb198d44a29a09221614adc06e1f326bb223
- SHA512
  
  7e9ecfe21fe97ea968efe5def092f41b116cd0dcb426332ad32a1a4c2b08ec6148dfb488d128bfebb71c86e80eb2856b208ef7cc7661664304a80f0fc98297e6
- SSDEEP
  
  3072:nahKyd2n31e53ARYX0VRgCQT7Uf5qpsd851Ffdis8AFfA+:nahOkX0VRQXUf5qGd851hffB
Score

10^/10

vidar 1774 persistence stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vidar1774persistencestealer

behavioral2