Overview

overview

10

Static

static

1

Date2023.exe

windows7-x64

10

Date2023.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Date2023.zip

  • Size

    285KB

  • Sample

    230326-ssw6waah7t

  • MD5

    784ba6de377f37914a972e0705c0f7fa

  • SHA1

    07e832b22eb1ea8c42b8cb37ab945670dd9ac6d6

  • SHA256

    7cea19a4ea0c66a02483114e97c4daeecbb654938c86a54bb2f3704ff6766b09

  • SHA512

    094468a3930fba5ffe4c03e3ab902a318230d25946474edae0bacde2b21f67fbb6a51dc85ed26ffbccd681629e80ffb77efa6d976577d7d02a543126dc0f9a7c

  • SSDEEP

    6144:5njzytt7TYcGJ+EEqUatbP6aiVrREW8RdBUOGUxqXCd5iz:9/Mt7hu+EEqN9P6aiW4O1x4Siz

Score
10/10
vidare37abeff0df24a473dacaf8467d6fa48discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

3

Botnet

e37abeff0df24a473dacaf8467d6fa48

C2

https://t.me/zaskullz

https://steamcommunity.com/profiles/76561199486572327

http://135.181.87.234:80
Attributes
  • profile_id_v2

    e37abeff0df24a473dacaf8467d6fa48

Targets

    • Target

      Date2023.exe

    • Size

      1024KB

    • MD5

      f7fd4791be2e2624b7fbb1d91ab2f539

    • SHA1

      5e293bd82fc478a0891a092e02a7576d6a9799d9

    • SHA256

      be82beca4c46e17fb1d4e7f23cf028f61b0d6e64d39146f31f1e7072ecf95fbe

    • SHA512

      340d18119fe408976e06e78ab8fa44c900981b25025389e6da674d662945986456d6ed98ffc7a478ff9583b147cb77a4df339e6e4b9734952c69693e53e20882

    • SSDEEP

      6144:7GZnGSyQWFr8FG6d68UeCVMlVTgjwAaTJVM0ASpk4hHsbPZ0kuydk3CKxh4:aXy7YKxeCVgxJA0ASp2tA

    Score
    10/10
    vidare37abeff0df24a473dacaf8467d6fa48discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks