General

  • Target

    file.exe

  • Size

    3.9MB

  • Sample

    221130-l58bcaah22

  • MD5

    9c3c87d5e02936d71413e832f7c0dbe9

  • SHA1

    d3a691cc3af3260f8e72e032f14d62c5b70e2bc8

  • SHA256

    317bcd852a5793fdbb1667d9ddbab72ae0c6eb28c6f1873cdb2bfa439ec5cf12

  • SHA512

    8dd56f4ee9ed203caa9f0dd237b720e8eca65b1cf1a841e0291281cdc6f36ae212d7cb120466922b547806d28098a0ceb350a42d5e22f2333dcaed61f07836d8

  • SSDEEP

    98304:79UDnKDOkISzfzatyyZnLlgv5LaZuZxgw/xnKo:UnKD/B2yC5M5Lai7/xl

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1679

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes
  • profile_id

    1679

Targets

    • Target

      file.exe

    • Size

      3.9MB

    • MD5

      9c3c87d5e02936d71413e832f7c0dbe9

    • SHA1

      d3a691cc3af3260f8e72e032f14d62c5b70e2bc8

    • SHA256

      317bcd852a5793fdbb1667d9ddbab72ae0c6eb28c6f1873cdb2bfa439ec5cf12

    • SHA512

      8dd56f4ee9ed203caa9f0dd237b720e8eca65b1cf1a841e0291281cdc6f36ae212d7cb120466922b547806d28098a0ceb350a42d5e22f2333dcaed61f07836d8

    • SSDEEP

      98304:79UDnKDOkISzfzatyyZnLlgv5LaZuZxgw/xnKo:UnKD/B2yC5M5Lai7/xl

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks