Behavioral task
behavioral1
Sample
c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe
Resource
win10v2004-20231215-en
General
-
Target
13765222373.zip
-
Size
478KB
-
MD5
742b5c8d98bbcc48a58e85aa30c92186
-
SHA1
d33842608bbba7a67663771c49a4d944d9c79a72
-
SHA256
433c5a7aaeb52e6d45a21a8e5052c9abd43c27c819a55a4d6778d4ebff59d6a3
-
SHA512
fc6e769daa18ac369752ad86e03bbd8fcf043270dff716fb12838fdd9347377bbd89bc450e4d63d4c914966427685d23e2fe1d593dbddb89d6aa779fa16f2766
-
SSDEEP
12288:0GbI4/rNPF0bWmNqCstlLG3KFJaan8HTBOMtZ/9tO+u4G:0YvFWbWmNqFlKaCaWTB1tHtOF4G
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Signatures
-
Vidar Stealer 1 IoCs
resource yara_rule static1/unpack001/c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376 family_vidar -
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376
Files
-
13765222373.zip.zip
Password: infected
-
c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe windows:5 windows x86 arch:x86
Password: infected
d7a3f04d58e3c67894b307c648c38b29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
HeapAlloc
GetProcessHeap
HeapFree
lstrcatA
CreateDirectoryA
FindClose
FindNextFileW
DeleteFileW
lstrcmpW
FindFirstFileW
lstrcatW
lstrcpyW
FindNextFileA
CopyFileA
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
DeleteFileA
GetCurrentProcessId
SetCurrentDirectoryA
CopyFileW
CloseHandle
WriteFile
CreateFileA
MultiByteToWideChar
ReadFile
GetFileSize
GetVersionExA
GetFileSizeEx
GetCurrentDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetFileAttributesA
GetPrivateProfileSectionNamesA
FileTimeToSystemTime
InterlockedCompareExchange
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
SetFilePointer
SetEndOfFile
QueryPerformanceCounter
MapViewOfFile
LockFileEx
LockFile
LoadLibraryW
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
LocalAlloc
HeapCreate
GetVersionExW
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FormatMessageW
FormatMessageA
FlushFileBuffers
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
AreFileApisANSI
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetComputerNameA
IsWow64Process
GetCurrentProcess
GlobalMemoryStatus
GetModuleHandleA
GetUserDefaultLocaleName
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetLocaleInfoA
GetFileInformationByHandle
GetLocalTime
CompareStringW
SetStdHandle
WideCharToMultiByte
Sleep
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
SetEnvironmentVariableA
SetEnvironmentVariableW
GetModuleFileNameW
IsValidCodePage
GetOEMCP
GetACP
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
HeapDestroy
ExitProcess
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
RaiseException
RtlUnwind
ExitThread
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
WriteConsoleW
user32
GetDesktopWindow
advapi32
GetUserNameA
shell32
SHGetFolderPathA
SHFileOperationA
ShellExecuteA
shlwapi
PathMatchSpecA
PathMatchSpecW
gdiplus
GdiplusStartup
GdipGetImageEncoders
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipCloneImage
Sections
.text Size: 737KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE