General

  • Target

    95219fecd1650aeb838b8ea089fd694e38008676c9d06a932765990ec5feca25

  • Size

    445KB

  • Sample

    230424-3gegssgh8w

  • MD5

    57e1be4063ba4621f97de82111fd28e2

  • SHA1

    f7ed6a8802c44e855ceb08cc2989d97d8c9b6bc1

  • SHA256

    95219fecd1650aeb838b8ea089fd694e38008676c9d06a932765990ec5feca25

  • SHA512

    c2e59bd740ab276e6534a73188035558ffdadb64a7971a69e38800cbb7054390503281ffdcb9e6cef43219abb29a72ce867ad348dec725d9ace0ca0d6d5d3b64

  • SSDEEP

    6144:S/6bgjcTnJup4/ZuKJpxr1sJTeAi9yHyGdOmw5KyN8OqrUOoz09:S/6UAnJupkwKpZwTecHsm/yugE9

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

2234cb18bdcd93ea6f4e5f1473025a81

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    2234cb18bdcd93ea6f4e5f1473025a81

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Extracted

Family

laplas

C2

http://89.23.97.128

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Targets

    • Target

      95219fecd1650aeb838b8ea089fd694e38008676c9d06a932765990ec5feca25

    • Size

      445KB

    • MD5

      57e1be4063ba4621f97de82111fd28e2

    • SHA1

      f7ed6a8802c44e855ceb08cc2989d97d8c9b6bc1

    • SHA256

      95219fecd1650aeb838b8ea089fd694e38008676c9d06a932765990ec5feca25

    • SHA512

      c2e59bd740ab276e6534a73188035558ffdadb64a7971a69e38800cbb7054390503281ffdcb9e6cef43219abb29a72ce867ad348dec725d9ace0ca0d6d5d3b64

    • SSDEEP

      6144:S/6bgjcTnJup4/ZuKJpxr1sJTeAi9yHyGdOmw5KyN8OqrUOoz09:S/6UAnJupkwKpZwTecHsm/yugE9

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks