General

  • Target

    631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.zip

  • Size

    211KB

  • Sample

    240402-msmpjsfe7x

  • MD5

    2bdec2da3f4667dad66f0753c1ccd59c

  • SHA1

    cbd5f16e875cd07f202cb9083c91f5517056bad7

  • SHA256

    a426e2c0712359fce09a794333fc5d469e1cee6b12984290771522e4a5a2ffd0

  • SHA512

    c046cbc1f7940fb3553843439e977d4ce6428286f87ceb437f35ba41d61dbd0bdb830eb81c7d404646aa7576caa9e6221cfb5c379c0e38c64a2117bb2a545974

  • SSDEEP

    3072:zvQz6+CRx+bs4HgacLdpumHuW+4QJjkdCvUwwLO4Z9r0ab12ybej:bDRGs4HgacfPZ+4RdCvPqOS9DEeY

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    debff3f4f38e9beeaf8e215a762c8549

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

    • Target

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe

    • Size

      224KB

    • MD5

      78f23006210bda6b5e26b8cbefa9758a

    • SHA1

      b1a191597f5a2ecdd3b9185b89072cfae06ae5cd

    • SHA256

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907

    • SHA512

      cf073cd4df9b13a9c79d9908952b88e9aef7c57c208031a6a758b2e3176841dfaa90206228af0c6a08c3b266b06fcd46d00ebde9c98906408affec9fbd9d0cc2

    • SSDEEP

      6144:No9+UOY1p3TTTFt/rIQuwkpAoVBIiNeXtd5yE:NEOAZtXtueXtdR

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks