General

  • Target

    8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4.zip

  • Size

    211KB

  • Sample

    240402-msna3sfe7z

  • MD5

    1a6ae165cedfd663854a5fce807ba800

  • SHA1

    7a6c410cfd197a075d196f550a232d71e70b23b1

  • SHA256

    07de09e06db053aa05f5df3450999cdf7ea5a0bad186fddabfa02e84ea11dd89

  • SHA512

    30bee9f2e6ee984117ca3d720a5c95ab8bcc9b614ed806716a3255fb3d700bcdc02ddb6553750e43627bcdd7dcbe70a43624fc5ef111a3524a559ed4ec7bfd3f

  • SSDEEP

    6144:nv9UCrn8YQFFwavd2AjVXd1xhz6StLIDJpECu0:nVZ8NXp3jVtnhz6St+pEm

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    debff3f4f38e9beeaf8e215a762c8549

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

    • Target

      8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4.exe

    • Size

      224KB

    • MD5

      aba4db269a810b878f86ffabb47ca06c

    • SHA1

      d141ffdd0842ccbe7e471fd84d2dc0a64b4a954b

    • SHA256

      8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4

    • SHA512

      8dc43e4375180340bf78701aed48d4c9ace51d3a02d461ed9af9245407d01e5ad51e8408b819a396bf57c50dc5bd94caf60f6beae4f1cfba7beefcca893b370d

    • SSDEEP

      3072:fx/loYA7RGHfvz9Qd8TSh3e0gc2Fk798FoCLP/SFpn4B9MgVCNu2WxyhvXED:pLA7MzSd3e0gcmg4oaW4Xdxym

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks