Overview

overview

10

Static

static

3

81558a3c9c...70.exe

windows7-x64

10

81558a3c9c...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570.exe

  • Size

    422KB

  • Sample

    240409-b252psad65

  • MD5

    b0d93933d118e0736edd9c77579599a2

  • SHA1

    18f00d3d16eb674abb13ac425b50721512834473

  • SHA256

    81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570

  • SHA512

    2ef16c3c70ca09829c779d5d1e9b2370e6ed043f1109c807deed2dc119fb7411c9d505328f6cf719809c36e3fce0fbd9962eff55ec12ad84a8e04e32a62e9c47

  • SSDEEP

    6144:3ImWfejL3SWY9KMq/60bp1JOPaWeu6N1UPi93Bst0Kk2m8Riqnwu:3xY9KV/60bIPaDN14iOS8Riowu

Score
10/10
vidarstealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199662282318

https://t.me/t8jmhl
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0

Targets

    • Target

      81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570.exe

    • Size

      422KB

    • MD5

      b0d93933d118e0736edd9c77579599a2

    • SHA1

      18f00d3d16eb674abb13ac425b50721512834473

    • SHA256

      81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570

    • SHA512

      2ef16c3c70ca09829c779d5d1e9b2370e6ed043f1109c807deed2dc119fb7411c9d505328f6cf719809c36e3fce0fbd9962eff55ec12ad84a8e04e32a62e9c47

    • SSDEEP

      6144:3ImWfejL3SWY9KMq/60bp1JOPaWeu6N1UPi93Bst0Kk2m8Riqnwu:3xY9KV/60bIPaDN14iOS8Riowu

    Score
    10/10
    vidarstealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks