General

  • Target

    8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4.zip

  • Size

    211KB

  • Sample

    240402-qxa34aca37

  • MD5

    e71e1b95ec160c1d791b6d487cada934

  • SHA1

    acb6c093c9f37e91c4475d6fd04ac9c367ae0599

  • SHA256

    67172c7ebcc80758991f75d61ed645248b49914257a7485dfe6b53d00ffae0ea

  • SHA512

    acbe4c90280d366161ca2a8d3d90bf3e99847dcc4d56350d224f9969ed4b66dc51776f85264bee950bc50d52f47d89675671d27b83af6663b0726242edc7aae5

  • SSDEEP

    6144:6tsrkK2Sw9dDCaCZst4qHVeCH/QCYbjvIEpB:yWkXp9dBoBjvZ

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    debff3f4f38e9beeaf8e215a762c8549

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

    • Target

      8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4.exe

    • Size

      224KB

    • MD5

      aba4db269a810b878f86ffabb47ca06c

    • SHA1

      d141ffdd0842ccbe7e471fd84d2dc0a64b4a954b

    • SHA256

      8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4

    • SHA512

      8dc43e4375180340bf78701aed48d4c9ace51d3a02d461ed9af9245407d01e5ad51e8408b819a396bf57c50dc5bd94caf60f6beae4f1cfba7beefcca893b370d

    • SSDEEP

      3072:fx/loYA7RGHfvz9Qd8TSh3e0gc2Fk798FoCLP/SFpn4B9MgVCNu2WxyhvXED:pLA7MzSd3e0gcmg4oaW4Xdxym

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks