General

  • Target

    631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.zip

  • Size

    211KB

  • Sample

    240402-qgnn9abc38

  • MD5

    aaae00829a4ebdee4d5732e0a56ba6e3

  • SHA1

    bc3964242104dd0e954ccae233d2bcbfcaddffc7

  • SHA256

    e8605a6eeadbd7552af4ca7c882c4a23fd0c5bfc37ade3629de5e512bc861a4f

  • SHA512

    548874fa39127749f51d7ee1abce8709fe8a1b7fbb2b83e7ffba02e573086d8ca43869474df7c946850d129fe61f12b2bc01e40089c622acc5974501214c8543

  • SSDEEP

    3072:DyhMFtwS9Yc2AFXvIkJF9+FaLtPldaFrcaD8jfmmqpWrEV6DrIluqdO+a0knXqZk:/jn9YTkII+FaLxErimmqdVj3IXq9qf

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    debff3f4f38e9beeaf8e215a762c8549

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

    • Target

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe

    • Size

      224KB

    • MD5

      78f23006210bda6b5e26b8cbefa9758a

    • SHA1

      b1a191597f5a2ecdd3b9185b89072cfae06ae5cd

    • SHA256

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907

    • SHA512

      cf073cd4df9b13a9c79d9908952b88e9aef7c57c208031a6a758b2e3176841dfaa90206228af0c6a08c3b266b06fcd46d00ebde9c98906408affec9fbd9d0cc2

    • SSDEEP

      6144:No9+UOY1p3TTTFt/rIQuwkpAoVBIiNeXtd5yE:NEOAZtXtueXtdR

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks