vidar | f74b85088fe251879fd8a4751c49ecc9f7572b5b28cd5a41f28949e6f8b094bd | Triage

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/04/2023, 15:28

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

409KB
MD5

67dcf917f9a6c220078f1568833b4b48
SHA1

e58cc6833fa5f1f6b202e384952230ab6e2c2de3
SHA256

f74b85088fe251879fd8a4751c49ecc9f7572b5b28cd5a41f28949e6f8b094bd
SHA512

4feea51c030eede785d96cda851978cd6e159261f90ec87bc5244fdb42399d1afa2f46dde83648fd4468e9c5fe3fc1c64b19b817993c807b4893ba555e07ad15
SSDEEP

6144:isIwtFG/KYG522FbS5hqb46hARH0QgdXFJK5ihlqbafc9qdNwHX1:iMtFG/KvnemLhE0QmF7hlqbmckdNw

Score

10^/10

vidar 78489afd9d9a4747beb445e5fb5b9c96 stealer

Malware Config

Extracted

Family

vidar

Version

3.6

Botnet

78489afd9d9a4747beb445e5fb5b9c96

C2

https://steamcommunity.com/profiles/76561199499188534

https://t.me/nutalse

Attributes

profile_id_v2
78489afd9d9a4747beb445e5fb5b9c96
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-55-0x0000000000280000-0x00000000002DD000-memory.dmp

Filesize
372KB

Download
memory/1560-56-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1560-60-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1560-62-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download