Overview

overview

10

Static

static

MEGAsync.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MEGAsync.exe.vir

  • Size

    325KB

  • Sample

    230103-e8z1tach9y

  • MD5

    9ed2d2cb3bb01f7f7183a1ec69ead315

  • SHA1

    cf139a943b728130022a7a4a3f527a529588ed86

  • SHA256

    cdf3cdb21337eca881dba7f718428b3a4b4b5e228f51980ee572e18d8c0e5cf8

  • SHA512

    236bec7125c066af77f07cd75207afccdde90fc9a261bc8dfa4951dc67d5badf353e870756c09d7c59f2e615fd65f504c1a7b1d7d9c11cb6982709d920712d41

  • SSDEEP

    6144:lZ4LjeUNqTBT6DnJSqEmZ8wi9BtpHZtJy4g26nC:lZ43eUNqQJdEmZSlXJy4g26n

Score
10/10
vidar14discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

1.8

Botnet

14

C2

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923
Attributes
  • profile_id

    14

Targets

    • Target

      MEGAsync.exe.vir

    • Size

      325KB

    • MD5

      9ed2d2cb3bb01f7f7183a1ec69ead315

    • SHA1

      cf139a943b728130022a7a4a3f527a529588ed86

    • SHA256

      cdf3cdb21337eca881dba7f718428b3a4b4b5e228f51980ee572e18d8c0e5cf8

    • SHA512

      236bec7125c066af77f07cd75207afccdde90fc9a261bc8dfa4951dc67d5badf353e870756c09d7c59f2e615fd65f504c1a7b1d7d9c11cb6982709d920712d41

    • SSDEEP

      6144:lZ4LjeUNqTBT6DnJSqEmZ8wi9BtpHZtJy4g26nC:lZ43eUNqQJdEmZSlXJy4g26n

    Score
    10/10
    vidar14discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks