Overview

overview

10

Static

static

Filmora2022.rar

windows7-x64

3

Filmora2022.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Filmora2022.rar

  • Size

    7.4MB

  • Sample

    230131-tzvr3aha93

  • MD5

    f112cc11f23a9495eba9f62a25b34c8a

  • SHA1

    3b9719b20701ecb646c1f3b8b1825c5386aa903c

  • SHA256

    2483a1b12399f4595e508bbffe727ce82f355c80d746553e6232fa7ac4e01687

  • SHA512

    a8d0098241965d57f859aad5eea8c081cffb4a81712faeb2825633c7308510b442d67db42f28206dfa6524a695f95cc3b36a6dc619e4af5bac05e1833c9239e9

  • SSDEEP

    196608:eZ0dhdzMH1e5YymThGI1TKN2xsiz2GzvSRTZh:eZ0dhdye5vihGIdKr3GzKRD

Score
10/10
vidar408evasionstealertrojan

Malware Config

Extracted

Family

vidar

Version

2.2

Botnet

408

C2

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815
Attributes
  • profile_id

    408

Targets

    • Target

      Filmora2022.rar

    • Size

      7.4MB

    • MD5

      f112cc11f23a9495eba9f62a25b34c8a

    • SHA1

      3b9719b20701ecb646c1f3b8b1825c5386aa903c

    • SHA256

      2483a1b12399f4595e508bbffe727ce82f355c80d746553e6232fa7ac4e01687

    • SHA512

      a8d0098241965d57f859aad5eea8c081cffb4a81712faeb2825633c7308510b442d67db42f28206dfa6524a695f95cc3b36a6dc619e4af5bac05e1833c9239e9

    • SSDEEP

      196608:eZ0dhdzMH1e5YymThGI1TKN2xsiz2GzvSRTZh:eZ0dhdye5vihGIdKr3GzKRD

    Score
    10/10
    vidar408evasionstealertrojan

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks