vidar | 0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9

Analysis

max time kernel
93s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:38

Target

Setup.exe
Size

780.4MB
MD5

828cfb01ed3c8a4fbe4960bc43bb3034
SHA1

cb44421d5eaa4930e115bc9c41803e3d04cc319c
SHA256

0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9
SHA512

1bedd5815ad14aa2298bff7f82e33a63358e99c107cecf8f5c0c7a8fd2fcc1ea9598b3dea519e89949d815166138a984dc721df55904329fa2b76dae527f86c7
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMF:jRyDSMxfoTM6

Score

10^/10

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2564-2-0x0000000000F10000-0x000000000193D000-memory.dmp	family_vidar_v7
behavioral2/memory/2564-8-0x0000000000F10000-0x000000000193D000-memory.dmp	family_vidar_v7
behavioral2/memory/2564-11-0x0000000000F10000-0x000000000193D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4280 2564 WerFault.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

2564 Setup.exe
2564 Setup.exe

pid	pid_target	process	target process
4280	2564	WerFault.exe	Setup.exe

pid	process
2564	Setup.exe
2564	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1368
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2564 -ip 2564
1⤵
PID:4276

memory/2564-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2564-3-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2564-2-0x0000000000F10000-0x000000000193D000-memory.dmp

Filesize
10.2MB

Download
memory/2564-1-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2564-4-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2564-5-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2564-6-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2564-7-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2564-8-0x0000000000F10000-0x000000000193D000-memory.dmp

Filesize
10.2MB

Download
memory/2564-11-0x0000000000F10000-0x000000000193D000-memory.dmp

Filesize
10.2MB

Download