Overview

overview

10

Static

static

1

Presentati...fo.exe

windows7-x64

1

Presentati...fo.exe

windows10-2004-x64

10

Resubmissions

04/09/2023, 06:25

230904-g6zndaeb61

02/09/2023, 20:13

230902-yzsd6afd3t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Presentation info.rar.7z
  • Size 75.5MB
  • Sample230902-yzsd6afd3t
  • SHA256 c484af9d90f4ee9db8f065be845eb6f47d7281e769e6e35a083790a6d66e4391
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vidar86277575c381e1fefb9bf290d771e6f1spywarestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 5.4

Botnet

  • 86277575c381e1fefb9bf290d771e6f1

C2

  • https://steamcommunity.com/profiles/76561199545993403

  • http://79.137.206.192:80

  • https://t.me/vogogor

Attributes
  • profile_id_v2

    86277575c381e1fefb9bf290d771e6f1

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13

Targets

    • Target
      Presentation info/Presentation info.exe
    • Size 93.2MB
    • SHA256 5e374fbc3960dd68c2cef4209851103f5623957e9815a0be720befd7899d3cc0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    vidar86277575c381e1fefb9bf290d771e6f1spywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks