Overview

overview

10

Static

static

1

Loader.rar

windows7-x64

10

Loader.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.rar

  • Size

    1.8MB

  • Sample

    230214-y7xzlsfd91

  • MD5

    20db25a9fea3c1be7c05243f4a785f47

  • SHA1

    93c957661c6fa16cf3444baf2ce5ded53e46feee

  • SHA256

    04fc208575dbe86f6239f612c8eddb0d9587b9c5a2e20ba5e96190f28ea61ce4

  • SHA512

    5e427fb5d5ccc6e38c00d0f6973b12b1075b319306a3beca394a93b792f08fcb9552923478265cdf68acb412eb80e8bc20f4764a577837aaf4ebd15bd9bd6ec9

  • SSDEEP

    49152:SWDAhMeJFuQzcRKrAXNWNCLByJNg8CzPFQrWMlMbKZVl9V:SWDAhM6FEKrA9iCLByJJgFkiYl9V

Score
10/10
vidar408spywarestealer

Malware Config

Extracted

Family

vidar

Version

2.5

Botnet

408

Attributes
  • profile_id

    408

Targets

    • Target

      Loader.rar

    • Size

      1.8MB

    • MD5

      20db25a9fea3c1be7c05243f4a785f47

    • SHA1

      93c957661c6fa16cf3444baf2ce5ded53e46feee

    • SHA256

      04fc208575dbe86f6239f612c8eddb0d9587b9c5a2e20ba5e96190f28ea61ce4

    • SHA512

      5e427fb5d5ccc6e38c00d0f6973b12b1075b319306a3beca394a93b792f08fcb9552923478265cdf68acb412eb80e8bc20f4764a577837aaf4ebd15bd9bd6ec9

    • SSDEEP

      49152:SWDAhMeJFuQzcRKrAXNWNCLByJNg8CzPFQrWMlMbKZVl9V:SWDAhM6FEKrA9iCLByJJgFkiYl9V

    Score
    10/10
    vidar408spywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks