Overview

overview

10

Static

static

3

06484299.exe

windows7-x64

10

06484299.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06484299.exe

  • Size

    6.6MB

  • Sample

    230603-stnwwshb73

  • MD5

    aed7475eff9160574e03f5e3a11eba24

  • SHA1

    efe6b817d2566646c7f8a500785f50f62a9cc717

  • SHA256

    8af7b10184f0205f0d7a00681884df539e18735f7e552574e386f53433aab221

  • SHA512

    e03387d9d74575b5da2d9c4a680dae8f5d70ce7e08eb8544975a3be7a3ed1af9479e9ab3452ed54e08f4cefc1e6c3460933b5fa259cd23a9e419c12baeae5d2a

  • SSDEEP

    196608:rbWpbdfWXab5zB7+B2R/qX4JmphW04IyWoHK4zk4iP12:4duXWO2RSX4JTIyWUk5M

Score
10/10
vidardb94123c97f84f48244aa87eb478e324discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

4.1

Botnet

db94123c97f84f48244aa87eb478e324

C2

https://steamcommunity.com/profiles/76561199510444991

https://t.me/task4manager
Attributes
  • profile_id_v2

    db94123c97f84f48244aa87eb478e324

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Targets

    • Target

      06484299.exe

    • Size

      6.6MB

    • MD5

      aed7475eff9160574e03f5e3a11eba24

    • SHA1

      efe6b817d2566646c7f8a500785f50f62a9cc717

    • SHA256

      8af7b10184f0205f0d7a00681884df539e18735f7e552574e386f53433aab221

    • SHA512

      e03387d9d74575b5da2d9c4a680dae8f5d70ce7e08eb8544975a3be7a3ed1af9479e9ab3452ed54e08f4cefc1e6c3460933b5fa259cd23a9e419c12baeae5d2a

    • SSDEEP

      196608:rbWpbdfWXab5zB7+B2R/qX4JmphW04IyWoHK4zk4iP12:4duXWO2RSX4JTIyWUk5M

    Score
    10/10
    vidardb94123c97f84f48244aa87eb478e324discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks