vidar | 2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687

Sharing

Copy URL Twitter E-mail

General

Target

2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687
Size

243KB
MD5

37976db9d0e6f8bf9db5ae4b56006d9d
SHA1

dda3158d09c332c054d01fa08ad9824cb00c7d6a
SHA256

2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687
SHA512

fb09c0a37f72f6f7cec57660f386c0a4042070b2db247e7638c426c44aba39b5f2bd09bbe2baf5ad5973de405e1aa60cc2a4e964e33776c0f0f930b60469af47
SSDEEP

6144:g6ueVDjvjWpG5W8OBMTSm/LwKrhoty3F7pDLZipt0:51jbgKW8L/LwKFoKvYpt0

Score

10^/10

stealer vidar stealc

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Stealc family
stealc
Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687

Files

2570478de33fd8035affc8658600653e13961eb0e378c27cdd462fb5ca90c687
.dll windows:5 windows x86 arch:x86

a8292c6fea28eccd2169562a0a333559

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

strlen
??_U@YAPAXI@Z
strcmp
memcmp
__CxxFrameHandler3
strncpy
malloc
_wtoi64
atexit
memchr
memmove
??_V@YAXPAX@Z
strtok_s
strchr
strcpy_s
memcpy
memset

kernel32

IsProcessorFeaturePresent
ExitProcess
lstrlenA
LocalAlloc
ReadProcessMemory
VirtualQueryEx
OpenProcess
FileTimeToSystemTime
CloseHandle
GetDriveTypeA
GetLogicalDriveStringsA
WaitForSingleObject
CreateThread
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryA
HeapAlloc
GetCurrentProcess
HeapFree
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetModuleHandleW
SetLastError
GetCurrentThreadId
Sleep

user32

CharToOemA

advapi32

RegOpenKeyExA
RegGetValueA
GetCurrentHwProfileA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
VariantInit
VariantClear
SysFreeString

shlwapi

ord155

Exports

Exports

Start

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8292c6fea28eccd2169562a0a333559

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 173KB - Virtual size: 172KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 4KB - Virtual size: 2.1MB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 173KB - Virtual size: 172KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 4KB - Virtual size: 2.1MB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 21KB - Virtual size: 20KB