Overview

overview

10

Static

static

3

340301d70f...25.exe

windows7-x64

3

340301d70f...25.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    340301d70f20bfbc4317a124d6fd8e3cce066bab570389759b1d55e8b7222b25.exe

  • Size

    7.6MB

  • Sample

    240221-dp5xaaah54

  • MD5

    57aa8011801f08ca21bd8043d2c78f26

  • SHA1

    c49615ed8c4dbfe9bf6b6d8de6b6a8eb55631a64

  • SHA256

    340301d70f20bfbc4317a124d6fd8e3cce066bab570389759b1d55e8b7222b25

  • SHA512

    72b4410d7bef21cced6a22ea4b70f6b8c0711aab6973ad638059e9ef96c910d2e6a4ef0a183d2e7ad0b2185ea427d448539ef57afaa4c380cb8814b529ebdb50

  • SSDEEP

    98304:QCXy7PIzkQaedAwom72c25SMa9mJ0hQSDQNen:2IzkQadbAOIFOTen

Score
10/10
vidar90fbe0fcdb23e600d250c86f91e6abc9stealer

Malware Config

Extracted

Family

vidar

Version

7.9

Botnet

90fbe0fcdb23e600d250c86f91e6abc9

C2

https://t.me/hypergog

https://steamcommunity.com/profiles/76561199642171824
Attributes
  • profile_id_v2

    90fbe0fcdb23e600d250c86f91e6abc9

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36

Targets

    • Target

      340301d70f20bfbc4317a124d6fd8e3cce066bab570389759b1d55e8b7222b25.exe

    • Size

      7.6MB

    • MD5

      57aa8011801f08ca21bd8043d2c78f26

    • SHA1

      c49615ed8c4dbfe9bf6b6d8de6b6a8eb55631a64

    • SHA256

      340301d70f20bfbc4317a124d6fd8e3cce066bab570389759b1d55e8b7222b25

    • SHA512

      72b4410d7bef21cced6a22ea4b70f6b8c0711aab6973ad638059e9ef96c910d2e6a4ef0a183d2e7ad0b2185ea427d448539ef57afaa4c380cb8814b529ebdb50

    • SSDEEP

      98304:QCXy7PIzkQaedAwom72c25SMa9mJ0hQSDQNen:2IzkQadbAOIFOTen

    Score
    10/10
    vidar90fbe0fcdb23e600d250c86f91e6abc9stealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks