Overview

overview

10

Static

static

3

1nstaIIER-S4t-UP.rar

windows7-x64

10

1nstaIIER-S4t-UP.rar

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1nstaIIER-S4t-UP.rar

  • Size

    123.0MB

  • Sample

    240324-f4z1pacf7z

  • MD5

    68f147e3b4adba7973bc414db731b888

  • SHA1

    29fb5fa1f4170f2dd58e4d28f325fd5ee0e2b270

  • SHA256

    29a245f9b70d99e57dd0fda398d88029c4f258d74f805eaf5c1c8e7aba042fdd

  • SHA512

    bb0eff75daac6c88f708c025b2bebfd00d52d8db3953e73230ee8459f6021d827123c2a7d1d9343501b050bc5716e8ed4069e4555995e7a03ced8ec26efe687c

  • SSDEEP

    3145728:EDPNOdh5gi0uX+gYkDbxUlY5bBEihprWlrzik:EjNwhbxYk3xUwB3YOk

Score
10/10
vidar97b92d10859a319d8736cd53ff3f8868stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

C2

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579
Attributes
  • profile_id_v2

    97b92d10859a319d8736cd53ff3f8868

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Targets

    • Target

      1nstaIIER-S4t-UP.rar

    • Size

      123.0MB

    • MD5

      68f147e3b4adba7973bc414db731b888

    • SHA1

      29fb5fa1f4170f2dd58e4d28f325fd5ee0e2b270

    • SHA256

      29a245f9b70d99e57dd0fda398d88029c4f258d74f805eaf5c1c8e7aba042fdd

    • SHA512

      bb0eff75daac6c88f708c025b2bebfd00d52d8db3953e73230ee8459f6021d827123c2a7d1d9343501b050bc5716e8ed4069e4555995e7a03ced8ec26efe687c

    • SSDEEP

      3145728:EDPNOdh5gi0uX+gYkDbxUlY5bBEihprWlrzik:EjNwhbxYk3xUwB3YOk

    Score
    10/10
    vidar97b92d10859a319d8736cd53ff3f8868stealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks