vidar | 54f4c5cc097a37ed8aa2da97869bd7251f68020b3c1dd66ea977bacaf717817c

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 336KB
Sample230602-bbhhqahe8s
SHA256 54f4c5cc097a37ed8aa2da97869bd7251f68020b3c1dd66ea977bacaf717817c
MD5 20de865da804355d73d8d1b5924b4c13
SHA1 0659b2e3847edc555ed5dc92e0a7bfb588fe8062
SHA512 61d48e80cafc83c09b07e342915f4a95241a75d5040ac95d432869bfd5406b941ff670114fc692fc10b08af39aa237efb4d25b86934bd81ba4214228f10d9874
SSDEEP 6144:pDnR1qkR47xM2MoOTVnAMpveKuV57KbN:pDnvVR43MNpnDuV1A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar a247b760bbf343752090be1436805458 spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

a247b760bbf343752090be1436805458

https://t.me/task4manager
http://23.88.46.113:80
https://steamcommunity.com/profiles/76561199510444991

Attributes

profile_id_v2
a247b760bbf343752090be1436805458
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Loads dropped DLL 2 IoCs

pid	Process
1348	file.exe
1348	file.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 62KB
SHA256 7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1
MD5 b5fcc55cffd66f38d548e8b63206c5e6
SHA1 79db08ababfa33a4f644fa8fe337195b5aba44c7
SHA512 aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1348-55-0x0000000000220000-0x0000000000276000-memory.dmp

Download

memory/1348-56-0x0000000000400000-0x0000000002580000-memory.dmp

Download

memory/1348-100-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1348-141-0x0000000000400000-0x0000000002580000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads