Overview

overview

10

Static

static

3

dd854f2822...d8.exe

windows7-x64

10

dd854f2822...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd854f282245a0bebcf6815b3106dbd8

  • Size

    643KB

  • Sample

    240325-jy4ngaah93

  • MD5

    dd854f282245a0bebcf6815b3106dbd8

  • SHA1

    b1815d9205d58219996f3282ccd9e7a544183082

  • SHA256

    5b292aa6b40327dc8a136a7585c381d6a6ecbe121a6210d7818eb2a4d35345ee

  • SHA512

    b225067ffdb5e5ae5ca36f0af5652cb026011b60ce0bf567956201ed399de02b9cb14e825caf4f9f45eee39a8383e48935430be95427777bb60a60ebffe339fc

  • SSDEEP

    12288:s8tWGc+VfJezVfhWSUB+N7D54tFyATO7E4gWI+DaZ4VOv:sGc+aVfzUs20Yp+o

Score
10/10
vidar399discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

39.3

Botnet

399

C2

https://bandakere.tumblr.com/

Attributes
  • profile_id

    399

Targets

    • Target

      dd854f282245a0bebcf6815b3106dbd8

    • Size

      643KB

    • MD5

      dd854f282245a0bebcf6815b3106dbd8

    • SHA1

      b1815d9205d58219996f3282ccd9e7a544183082

    • SHA256

      5b292aa6b40327dc8a136a7585c381d6a6ecbe121a6210d7818eb2a4d35345ee

    • SHA512

      b225067ffdb5e5ae5ca36f0af5652cb026011b60ce0bf567956201ed399de02b9cb14e825caf4f9f45eee39a8383e48935430be95427777bb60a60ebffe339fc

    • SSDEEP

      12288:s8tWGc+VfJezVfhWSUB+N7D54tFyATO7E4gWI+DaZ4VOv:sGc+aVfzUs20Yp+o

    Score
    10/10
    vidar399discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks