Overview

overview

10

Static

static

1

Filmora2023.exe

windows7-x64

10

Filmora2023.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Filmora2023.exe

  • Size

    761.7MB

  • Sample

    230205-c7sh8sbc4v

  • MD5

    e9b86872f7ccb57f84737364128b7cc9

  • SHA1

    cc4edb90af92ae6b3e3122e6c3f35ed8f2b6d895

  • SHA256

    3a87f4c5773d261302d59628ecd88ef4de554c5d8ff90bdc0876c2d780779ddf

  • SHA512

    863e31eed9e359b89d121d5730a1350c37c757d1e3ae3f1fdfcc2d67a56eb6c5a19610a6234025530376f22c2a5c4f7d8bb329f276f95f753a2c15a46379e393

  • SSDEEP

    12288:Dudb7OgMxQ0Q2hxPSmIcqMvqYUtirJuD1mK3h1fNQ:S9n70Q2hZSmIcq6qjTb3/NQ

Score
10/10
vidar408spywarestealerupx

Malware Config

Extracted

Family

vidar

Version

2.3

Botnet

408

C2

https://t.me/mantarlars

https://steamcommunity.com/profiles/76561199474840123
Attributes
  • profile_id

    408

Targets

    • Target

      Filmora2023.exe

    • Size

      761.7MB

    • MD5

      e9b86872f7ccb57f84737364128b7cc9

    • SHA1

      cc4edb90af92ae6b3e3122e6c3f35ed8f2b6d895

    • SHA256

      3a87f4c5773d261302d59628ecd88ef4de554c5d8ff90bdc0876c2d780779ddf

    • SHA512

      863e31eed9e359b89d121d5730a1350c37c757d1e3ae3f1fdfcc2d67a56eb6c5a19610a6234025530376f22c2a5c4f7d8bb329f276f95f753a2c15a46379e393

    • SSDEEP

      12288:Dudb7OgMxQ0Q2hxPSmIcqMvqYUtirJuD1mK3h1fNQ:S9n70Q2hZSmIcq6qjTb3/NQ

    Score
    10/10
    vidar408spywarestealerupx

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks