Overview

overview

10

Static

static

3

18c960230d...f0.exe

windows7-x64

10

18c960230d...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18c960230dd536a0d62f98d6ec723ff0

  • Size

    616KB

  • Sample

    231230-pvpyssadhj

  • MD5

    18c960230dd536a0d62f98d6ec723ff0

  • SHA1

    ab8b12d852f35deb702a0e92c18099fa08af04e1

  • SHA256

    381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

  • SHA512

    3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

  • SSDEEP

    12288:12080d6D6Vluzdkk24m6tnjVRopKP73d/eugx45HrE0np20Tq7wgXc6:O0d6jmsryKN/5Hrz2eq7wL6

Score
10/10
vidar517stealer

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

517

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    517

Targets

    • Target

      18c960230dd536a0d62f98d6ec723ff0

    • Size

      616KB

    • MD5

      18c960230dd536a0d62f98d6ec723ff0

    • SHA1

      ab8b12d852f35deb702a0e92c18099fa08af04e1

    • SHA256

      381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

    • SHA512

      3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

    • SSDEEP

      12288:12080d6D6Vluzdkk24m6tnjVRopKP73d/eugx45HrE0np20Tq7wgXc6:O0d6jmsryKN/5Hrz2eq7wL6

    Score
    10/10
    vidar517stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks