Overview

overview

10

Static

static

1

16274daca7...24.exe

windows7-x64

10

16274daca7...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16274daca70d541c57399c2156360124

  • Size

    3.2MB

  • Sample

    230314-ev2mgsdb98

  • MD5

    16274daca70d541c57399c2156360124

  • SHA1

    4e5790cb7dbb3714d26140bd319410a90352c340

  • SHA256

    c0bfc01fc145322a9194eb2ca9d75285312805b577bcf8e6ca510d59389f4ab3

  • SHA512

    ecb87230f114d88c0adf791b32d682a97841991274e7654cd498420dc8da61e90738a04e757c3c08cf99df777e5486e4576f94157956f8ce0aba67c8e703cc53

  • SSDEEP

    98304:6CDrrzdb8PIJOvYWrn/LjdPUmTgebZ9X2IXd0v:zDvzdwgJhWrdxtbZl

Score
10/10
vidar813discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

2.6

Botnet

813

C2

https://t.me/robertotalks

https://steamcommunity.com/profiles/76561199480821604

http://95.217.157.160:80
Attributes
  • profile_id

    813

Targets

    • Target

      16274daca70d541c57399c2156360124

    • Size

      3.2MB

    • MD5

      16274daca70d541c57399c2156360124

    • SHA1

      4e5790cb7dbb3714d26140bd319410a90352c340

    • SHA256

      c0bfc01fc145322a9194eb2ca9d75285312805b577bcf8e6ca510d59389f4ab3

    • SHA512

      ecb87230f114d88c0adf791b32d682a97841991274e7654cd498420dc8da61e90738a04e757c3c08cf99df777e5486e4576f94157956f8ce0aba67c8e703cc53

    • SSDEEP

      98304:6CDrrzdb8PIJOvYWrn/LjdPUmTgebZ9X2IXd0v:zDvzdwgJhWrdxtbZl

    Score
    10/10
    vidar813discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks