vidar

General

Target

b1e5a8d601ddf099e3e25c1cc2e2c65f471002dbdd4df1241ac5d014f163cd25.exe
Size

354KB
Sample

240320-c265fafd7w
MD5

537c811241dd180a6c950d208520c6a5
SHA1

748d1a1c07b106f065b0c1691ad88bed2a14233f
SHA256

b1e5a8d601ddf099e3e25c1cc2e2c65f471002dbdd4df1241ac5d014f163cd25
SHA512

1e5b2e96e1369c9cc749615e346718b6e061ce91ba7cd9d241f5c2a391bb3be0a7b89d975a5955a426d6a778ccd361f4eff7e6e1292ec1df43620f764d5fdf37
SSDEEP

6144:7ntVu+z4DpPFPdv1PgQBvnsKghTzHEWG5EHLxy+AE:7Z8nPdvlIDHLxy

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

8.4

Botnet

4cf8d799a3641f9821e54be56c960e28

C2

https://steamcommunity.com/profiles/76561199654112719

https://t.me/r2d0s

Attributes

profile_id_v2
4cf8d799a3641f9821e54be56c960e28
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Targets

- Target
  
  b1e5a8d601ddf099e3e25c1cc2e2c65f471002dbdd4df1241ac5d014f163cd25.exe
- Size
  
  354KB
- MD5
  
  537c811241dd180a6c950d208520c6a5
- SHA1
  
  748d1a1c07b106f065b0c1691ad88bed2a14233f
- SHA256
  
  b1e5a8d601ddf099e3e25c1cc2e2c65f471002dbdd4df1241ac5d014f163cd25
- SHA512
  
  1e5b2e96e1369c9cc749615e346718b6e061ce91ba7cd9d241f5c2a391bb3be0a7b89d975a5955a426d6a778ccd361f4eff7e6e1292ec1df43620f764d5fdf37
- SSDEEP
  
  6144:7ntVu+z4DpPFPdv1PgQBvnsKghTzHEWG5EHLxy+AE:7Z8nPdvlIDHLxy
Score

10^/10

vidar zgrat 4cf8d799a3641f9821e54be56c960e28 rat stealer
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Detect ZGRat V1

ZGRat

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2