vidar | a5b295d5166a6ffd1191cccc9d1dff8f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a5b295d5166a6ffd1191cccc9d1dff8f.exe
Size

189KB
MD5

a5b295d5166a6ffd1191cccc9d1dff8f
SHA1

a9b537a09ce7c3937c16944c06d8d00c8c3ccdfe
SHA256

78c5de231f5085d084f126c4b49db26464449b0008a6f665bbad998e7c2c8141
SHA512

436d2d7823a9f022a6c732a3e5acc3f388cb224e1a52936111a1febc48a3f22d4442f0cdf9285c22d52fc360ffbf6aa1f05aef455ee2b9099c758e2f75f63745
SSDEEP

3072:BvzA6O0w5tsUTQsVgOc8yvY9emTKWBoynYenXZoLG6XwwTWtlg5:Bs50Itjks6Oc8ygNKDyYeIrCtlg5

Score

10^/10

stealer 3000b4571a5457d4ddd93c66fc409ad3 vidar

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

3000b4571a5457d4ddd93c66fc409ad3

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
3000b4571a5457d4ddd93c66fc409ad3
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5b295d5166a6ffd1191cccc9d1dff8f.exe

Files

a5b295d5166a6ffd1191cccc9d1dff8f.exe
.exe windows:5 windows x86 arch:x86

9f7f0b9085b628f0bac4f05bc2d2bce2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_EH_prolog
strlen
memcmp
__CxxFrameHandler3
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memmove
memchr
strtok_s
strcpy_s
strchr
memcpy
??_U@YAPAXI@Z
memset

kernel32

IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
ExitProcess
GetCurrentProcess
lstrlenW
lstrlenA
LocalAlloc
ReadProcessMemory
VirtualQueryEx
OpenProcess
FileTimeToSystemTime
CloseHandle
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
GetProcAddress
LoadLibraryA
HeapAlloc
VirtualAllocExNuma
HeapFree
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetModuleHandleW
SetLastError
GetCurrentThreadId

user32

CharToOemA

advapi32

RegOpenKeyExA
RegGetValueA
GetCurrentHwProfileA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

shlwapi

ord155

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

9f7f0b9085b628f0bac4f05bc2d2bce2

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 2.1MB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 2.1MB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 20KB - Virtual size: 19KB