vidar

General

Target

https://mega.nz/file/n7hgFbTB#0P3vn58q-WXoc-En6zZ5Y8Lolmqfrjf5JPhUOLGT-j4
Sample

240222-pmdksshd66

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

7.9

Botnet

c0f701b124b29a9e188f7796b890e60b

C2

https://49.13.32.193

https://t.me/hypergog

https://steamcommunity.com/profiles/76561199642171824

Attributes

profile_id_v2
c0f701b124b29a9e188f7796b890e60b
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36

Targets

- Target
  
  https://mega.nz/file/n7hgFbTB#0P3vn58q-WXoc-En6zZ5Y8Lolmqfrjf5JPhUOLGT-j4
Score

10^/10

vidar c0f701b124b29a9e188f7796b890e60b stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1