Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://www.mediafir...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.mediafire.com/file/3asythl9dpbod2a/Recommendations_for_the_hotel.rar/file

  • Sample

    230901-hspfxsdb8x

Score
10/10
vidar1f6859b27171c7c80d5e127fcbd689c2discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

5.4

Botnet

1f6859b27171c7c80d5e127fcbd689c2

C2

https://t.me/vogogor

https://steamcommunity.com/profiles/76561199545993403
Attributes
  • profile_id_v2

    1f6859b27171c7c80d5e127fcbd689c2

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13

Targets

    • Target

      https://www.mediafire.com/file/3asythl9dpbod2a/Recommendations_for_the_hotel.rar/file

    Score
    10/10
    vidar1f6859b27171c7c80d5e127fcbd689c2discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks