Overview

overview

10

Static

static

3

03187999.exe

windows7-x64

10

03187999.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    03187999.exe

  • Size

    374KB

  • Sample

    230530-jnv9cage8v

  • MD5

    f29e32326c105d763e88b9ded0d12ffc

  • SHA1

    0f0c4a222d79841253fb1894925588b7c60193d1

  • SHA256

    2e05e4d2d7b1d6d1b1caa909037f39057c9a929e53849a0ed49e5d001afd7508

  • SHA512

    40d48399d3df936b7230325aa3216a89292d30617bd5cffc710efa5ae48c4d976c1e85f582cb880ca7dca1188b260167b6b5de51e505a62440099a36c097943b

  • SSDEEP

    6144:CzVhrwOhYNouYMQCk5mwvFxHgVv83I/AGV6MTS1mbj/a5:ITJYSFMQ/mGFxHgm6HS1m/M

Score
10/10
vidara247b760bbf343752090be1436805458discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

4.1

Botnet

a247b760bbf343752090be1436805458

C2

https://t.me/task4manager

http://23.88.46.113:80

https://steamcommunity.com/profiles/76561199510444991
Attributes
  • profile_id_v2

    a247b760bbf343752090be1436805458

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Targets

    • Target

      03187999.exe

    • Size

      374KB

    • MD5

      f29e32326c105d763e88b9ded0d12ffc

    • SHA1

      0f0c4a222d79841253fb1894925588b7c60193d1

    • SHA256

      2e05e4d2d7b1d6d1b1caa909037f39057c9a929e53849a0ed49e5d001afd7508

    • SHA512

      40d48399d3df936b7230325aa3216a89292d30617bd5cffc710efa5ae48c4d976c1e85f582cb880ca7dca1188b260167b6b5de51e505a62440099a36c097943b

    • SSDEEP

      6144:CzVhrwOhYNouYMQCk5mwvFxHgVv83I/AGV6MTS1mbj/a5:ITJYSFMQ/mGFxHgm6HS1m/M

    Score
    10/10
    vidara247b760bbf343752090be1436805458discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks