vidar | 29a245f9b70d99e57dd0fda398d88029c4f258d74f805eaf5c1c8e7aba042fdd

Analysis

max time kernel
119s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 04:14

Target

LauncherPC_S0FT/Setup.exe
Size

596.1MB
MD5

50e223cad778bd1522afb534c1001778
SHA1

c7d7c614db48197e4474bfb496fce381ece2cb2f
SHA256

4aa7d4f2627fd363785f92635f3d3aebb2256a2366517fe50868f38c2563b1f9
SHA512

3e236b0655e45f7b1aa8a91c719a6d3c093a769971b9f3e17492b49f62eafbbc3bd0ffd3a9eceee86b262899174b2fc00df902d5a31686bb394a857c13f0004e
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGM0:jRyDSMxfoTC

Score

10^/10

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/4116-1-0x0000000000E30000-0x000000000185D000-memory.dmp	family_vidar_v7
behavioral1/memory/4116-8-0x0000000000E30000-0x000000000185D000-memory.dmp	family_vidar_v7
behavioral1/memory/4116-11-0x0000000000E30000-0x000000000185D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 4116 WerFault.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

4116 Setup.exe
4116 Setup.exe

pid	pid_target	process	target process
2672	4116	WerFault.exe	Setup.exe

pid	process
4116	Setup.exe
4116	Setup.exe

C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1444
  2⤵
  - Program crash
  PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4116 -ip 4116
1⤵
PID:1540

memory/4116-1-0x0000000000E30000-0x000000000185D000-memory.dmp

Filesize
10.2MB

Download
memory/4116-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4116-3-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4116-5-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/4116-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4116-4-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4116-6-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4116-7-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4116-8-0x0000000000E30000-0x000000000185D000-memory.dmp

Filesize
10.2MB

Download
memory/4116-11-0x0000000000E30000-0x000000000185D000-memory.dmp

Filesize
10.2MB

Download