General

  • Target

    BB8865FC5B4DDEA351AE406E6038D64F

  • Size

    380KB

  • Sample

    221213-jef33agh7w

  • MD5

    bb8865fc5b4ddea351ae406e6038d64f

  • SHA1

    25fb72d7a15d45c088c3d1f3a544d7c87c772d0e

  • SHA256

    0f5d584cc609533cf59d87bc0043bed73b091898be9ee7f1251933895e0f2991

  • SHA512

    85160e2d3a9f11a6eaf7e2eb1d11df69602a564847794f4fd7138e1f932d9afe9d86b55ffd1d1c25e2bca420c174ae27b7fd4b5aef17f9bf090cf856912476fe

  • SSDEEP

    6144:oq0Ney4vNvfGFhndcz3ZXgvEI0JmAuWeF3Dr0w:oq0ky4vVf2hndS3ZwcI/tVP0w

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1672

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804

Attributes
  • profile_id

    1672

Targets

    • Target

      BB8865FC5B4DDEA351AE406E6038D64F

    • Size

      380KB

    • MD5

      bb8865fc5b4ddea351ae406e6038d64f

    • SHA1

      25fb72d7a15d45c088c3d1f3a544d7c87c772d0e

    • SHA256

      0f5d584cc609533cf59d87bc0043bed73b091898be9ee7f1251933895e0f2991

    • SHA512

      85160e2d3a9f11a6eaf7e2eb1d11df69602a564847794f4fd7138e1f932d9afe9d86b55ffd1d1c25e2bca420c174ae27b7fd4b5aef17f9bf090cf856912476fe

    • SSDEEP

      6144:oq0Ney4vNvfGFhndcz3ZXgvEI0JmAuWeF3Dr0w:oq0ky4vVf2hndS3ZwcI/tVP0w

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Tasks