General

  • Target

    718C76F00949C2AA03647C8B16C89325

  • Size

    394KB

  • Sample

    221213-fxm3jsgg3v

  • MD5

    718c76f00949c2aa03647c8b16c89325

  • SHA1

    a1ed33510d0f8b1f0f635e23c101524df4a29015

  • SHA256

    e73f81cc13621d5616984fc7586b3f1c823a2b82c6d63d75fa02591f22f23058

  • SHA512

    0e3c283bf5cb8ba8053d4c61fdbb6f669cc06d637f10bd013c0161192057f98d4cd60644ef35a663e54a468de4a28a6ca563cd43065f6e53cc519f2be3991fbd

  • SSDEEP

    6144:gjJLlbUB2gIwnqTMYPMD7MddS//WK/Dtt9sqL0B3RbhkdSyertCtPd2yV:EhUChT3PMD4cWGLzL0BLkdgtCtg

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1672

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804

Attributes
  • profile_id

    1672

Targets

    • Target

      718C76F00949C2AA03647C8B16C89325

    • Size

      394KB

    • MD5

      718c76f00949c2aa03647c8b16c89325

    • SHA1

      a1ed33510d0f8b1f0f635e23c101524df4a29015

    • SHA256

      e73f81cc13621d5616984fc7586b3f1c823a2b82c6d63d75fa02591f22f23058

    • SHA512

      0e3c283bf5cb8ba8053d4c61fdbb6f669cc06d637f10bd013c0161192057f98d4cd60644ef35a663e54a468de4a28a6ca563cd43065f6e53cc519f2be3991fbd

    • SSDEEP

      6144:gjJLlbUB2gIwnqTMYPMD7MddS//WK/Dtt9sqL0B3RbhkdSyertCtPd2yV:EhUChT3PMD4cWGLzL0BLkdgtCtg

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks