vidar

General

Target

9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe
Size

224KB
Sample

240312-dgys1agd42
MD5

c9d003abf616cf098a403f61cf7b05fd
SHA1

5c91878e5035fe1916f0ecd554c95a7ba23212a9
SHA256

9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75
SHA512

d6a0821ba51c50aa2c466995204b79b8ac115035a6e6d642bc2f1565f9763030b972e85f775eb2c0d833de61f9e06b9d7050708f615a48d64d5a9114449a05a1
SSDEEP

3072:gIhe0IhRT7cTX1y7rtEtXXXXQ6vU5uYTOZ9MIuZqLGNBrCyCbP:gIhe0+RvcclEtXnXteOZ9MI/LGdCb

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

8.1

Botnet

1ea8aee42f0abfcd960a0b72af3ab3d7

C2

https://steamcommunity.com/profiles/76561199649267298

https://t.me/uprizin

Attributes

profile_id_v2
1ea8aee42f0abfcd960a0b72af3ab3d7
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 OPR/96.0.0.0

Targets

- Target
  
  9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe
- Size
  
  224KB
- MD5
  
  c9d003abf616cf098a403f61cf7b05fd
- SHA1
  
  5c91878e5035fe1916f0ecd554c95a7ba23212a9
- SHA256
  
  9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75
- SHA512
  
  d6a0821ba51c50aa2c466995204b79b8ac115035a6e6d642bc2f1565f9763030b972e85f775eb2c0d833de61f9e06b9d7050708f615a48d64d5a9114449a05a1
- SSDEEP
  
  3072:gIhe0IhRT7cTX1y7rtEtXXXXQ6vU5uYTOZ9MIuZqLGNBrCyCbP:gIhe0+RvcclEtXnXteOZ9MI/LGdCb
Score

10^/10

vidar 1ea8aee42f0abfcd960a0b72af3ab3d7 stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2