vidar | 22856a6c833d238fca56eabc3398b1118a2893f0995448ca69c19a40d07f50de

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22856a6c833d238fca56eabc3398b1118a2893f0995448ca69c19a40d07f50de.exe
Size

2.6MB
MD5

8a24042598b0c07c593a6f728379ed12
SHA1

cfc334ef264e339084f5f9a425a1d8e3c7af98a8
SHA256

22856a6c833d238fca56eabc3398b1118a2893f0995448ca69c19a40d07f50de
SHA512

61cd3180261e538879e2c8eed8012107ad357e52fdd453c0038701228ce6b7e770a90ca1c941d3e1e05720eed881ebdeeae5d50e7ef48492aa265e0b60ef2484
SSDEEP

49152:VTCVHed6FUSPFMiy7J7Sy2/tTuUhnKLvO+MpfCGl9xh6Z:UUdCNPuhl7y/tlnKa+wfCGrw

Score

10^/10

vidar a2fafb95617b0c4575ae879e558a67a9 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

a2fafb95617b0c4575ae879e558a67a9

https://t.me/neoschats

https://steamcommunity.com/profiles/76561199644883218

Attributes

profile_id_v2
a2fafb95617b0c4575ae879e558a67a9
user_agent
Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/4016-0-0x0000000000ED0000-0x000000000153F000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4016	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\22856a6c833d238fca56eabc3398b1118a2893f0995448ca69c19a40d07f50de.exe
"C:\Users\Admin\AppData\Local\Temp\22856a6c833d238fca56eabc3398b1118a2893f0995448ca69c19a40d07f50de.exe"
1⤵
PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 2008
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
1⤵
PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4016-0-0x0000000000ED0000-0x000000000153F000-memory.dmp

Filesize
6.4MB

Download