General

  • Target

    _μ§€μ›μ„œ_221212(κ²½λ ₯사항도 같이 κΈ°μž¬ν•˜μ˜€μŠ΅λ‹ˆλ‹€ 잘 λΆ€νƒλ“œλ €μš”).exe

  • Size

    394KB

  • Sample

    221213-fbk13ade79

  • MD5

    718c76f00949c2aa03647c8b16c89325

  • SHA1

    a1ed33510d0f8b1f0f635e23c101524df4a29015

  • SHA256

    e73f81cc13621d5616984fc7586b3f1c823a2b82c6d63d75fa02591f22f23058

  • SHA512

    0e3c283bf5cb8ba8053d4c61fdbb6f669cc06d637f10bd013c0161192057f98d4cd60644ef35a663e54a468de4a28a6ca563cd43065f6e53cc519f2be3991fbd

  • SSDEEP

    6144:gjJLlbUB2gIwnqTMYPMD7MddS//WK/Dtt9sqL0B3RbhkdSyertCtPd2yV:EhUChT3PMD4cWGLzL0BLkdgtCtg

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1672

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804

Attributes
  • profile_id

    1672

Targets

    • Target

      _μ§€μ›μ„œ_221212(κ²½λ ₯사항도 같이 κΈ°μž¬ν•˜μ˜€μŠ΅λ‹ˆλ‹€ 잘 λΆ€νƒλ“œλ €μš”).exe

    • Size

      394KB

    • MD5

      718c76f00949c2aa03647c8b16c89325

    • SHA1

      a1ed33510d0f8b1f0f635e23c101524df4a29015

    • SHA256

      e73f81cc13621d5616984fc7586b3f1c823a2b82c6d63d75fa02591f22f23058

    • SHA512

      0e3c283bf5cb8ba8053d4c61fdbb6f669cc06d637f10bd013c0161192057f98d4cd60644ef35a663e54a468de4a28a6ca563cd43065f6e53cc519f2be3991fbd

    • SSDEEP

      6144:gjJLlbUB2gIwnqTMYPMD7MddS//WK/Dtt9sqL0B3RbhkdSyertCtPd2yV:EhUChT3PMD4cWGLzL0BLkdgtCtg

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks