Overview

overview

10

Static

static

3

0698c28008...1b.exe

windows7-x64

10

0698c28008...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0698c2800814f9a42532ed20f318ca1b

  • Size

    766KB

  • Sample

    231229-268w9sfea2

  • MD5

    0698c2800814f9a42532ed20f318ca1b

  • SHA1

    10caa66d97204438f3f1c1414d4d29f375efafa0

  • SHA256

    775e870468c83f0e155c1cd59731885bcce83232d13066b11d1faefc239b58a4

  • SHA512

    8735293e957f7fd50497e2f0b0fdb898f2d75f8449c7710d1beb0f055dbae3f1b7935008b7282795c81a5973a8842961cbe60aedd16c27ab1e00b1c74e50ec3d

  • SSDEEP

    12288:12080d6D6Vluzdkk24m6tnjVRopKP73d/eugx45HrE0np20Tq7wgXc6Rxf7I7emU:O0d6jmsryKN/5Hrz2eq7wL6HI6mHVepZ

Score
10/10
vidar517stealer

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

517

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    517

Targets

    • Target

      0698c2800814f9a42532ed20f318ca1b

    • Size

      766KB

    • MD5

      0698c2800814f9a42532ed20f318ca1b

    • SHA1

      10caa66d97204438f3f1c1414d4d29f375efafa0

    • SHA256

      775e870468c83f0e155c1cd59731885bcce83232d13066b11d1faefc239b58a4

    • SHA512

      8735293e957f7fd50497e2f0b0fdb898f2d75f8449c7710d1beb0f055dbae3f1b7935008b7282795c81a5973a8842961cbe60aedd16c27ab1e00b1c74e50ec3d

    • SSDEEP

      12288:12080d6D6Vluzdkk24m6tnjVRopKP73d/eugx45HrE0np20Tq7wgXc6Rxf7I7emU:O0d6jmsryKN/5Hrz2eq7wL6HI6mHVepZ

    Score
    10/10
    vidar517stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks