Overview

overview

10

Static

static

3

026217c8f9...bd.exe

windows7-x64

10

026217c8f9...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd.exe

  • Size

    232KB

  • Sample

    240229-fw3fvaee3z

  • MD5

    6bb59137fb112f7970ffeca6f23365cc

  • SHA1

    c2d3ad4d1f5ec85453b4d9f92f660c4ec23779fc

  • SHA256

    026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

  • SHA512

    04edf7bcbc190c772fa352f34abfd0f261973470f512b403d244f03465095d9a59cbf8427e722755564f8cbee3de1fa5292c776529cfbd08f0b2e3aa486e49b9

  • SSDEEP

    3072:sw7Q4Q0Xvbjsw9Nw6DNnsVid0HaaLnLHTfSKwqrYSKLoEZ4L4CM5e81:sUHQATAwVNWidUbAqzKLtwM5eq

Score
10/10
vidar522fef6d5a166879865036137c81cdebstealer

Malware Config

Extracted

Family

vidar

Version

8

Botnet

522fef6d5a166879865036137c81cdeb

C2

https://steamcommunity.com/profiles/76561199644883218

https://t.me/neoschats
Attributes
  • profile_id_v2

    522fef6d5a166879865036137c81cdeb

  • user_agent

    Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78

Targets

    • Target

      026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd.exe

    • Size

      232KB

    • MD5

      6bb59137fb112f7970ffeca6f23365cc

    • SHA1

      c2d3ad4d1f5ec85453b4d9f92f660c4ec23779fc

    • SHA256

      026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

    • SHA512

      04edf7bcbc190c772fa352f34abfd0f261973470f512b403d244f03465095d9a59cbf8427e722755564f8cbee3de1fa5292c776529cfbd08f0b2e3aa486e49b9

    • SSDEEP

      3072:sw7Q4Q0Xvbjsw9Nw6DNnsVid0HaaLnLHTfSKwqrYSKLoEZ4L4CM5e81:sUHQATAwVNWidUbAqzKLtwM5eq

    Score
    10/10
    vidar522fef6d5a166879865036137c81cdebstealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks