vidar | 8b303a6159b0bec7c19f1491762acbe19cd17e95eec50a484dd77cba9d622113

Analysis

max time kernel
91s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:27

Target

9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe
Size

224KB
MD5

c9d003abf616cf098a403f61cf7b05fd
SHA1

5c91878e5035fe1916f0ecd554c95a7ba23212a9
SHA256

9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75
SHA512

d6a0821ba51c50aa2c466995204b79b8ac115035a6e6d642bc2f1565f9763030b972e85f775eb2c0d833de61f9e06b9d7050708f615a48d64d5a9114449a05a1
SSDEEP

3072:gIhe0IhRT7cTX1y7rtEtXXXXQ6vU5uYTOZ9MIuZqLGNBrCyCbP:gIhe0+RvcclEtXnXteOZ9MI/LGdCb

Score

10^/10

Family

vidar

Version

8.1

Botnet

1ea8aee42f0abfcd960a0b72af3ab3d7

https://steamcommunity.com/profiles/76561199649267298

https://t.me/uprizin

Attributes

profile_id_v2
1ea8aee42f0abfcd960a0b72af3ab3d7
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 OPR/96.0.0.0

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3444-2-0x00000000006F0000-0x0000000000720000-memory.dmp	family_vidar_v7
behavioral2/memory/3444-3-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/3444-5-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/3444-8-0x00000000006F0000-0x0000000000720000-memory.dmp	family_vidar_v7
behavioral2/memory/3444-9-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3992 3444 WerFault.exe 9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe

pid	pid_target	process	target process
3992	3444	WerFault.exe	9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe

C:\Users\Admin\AppData\Local\Temp\9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe
"C:\Users\Admin\AppData\Local\Temp\9e60de921d09472b17a0e0e92a159c63b5cb0f07c5d290ae394b60f17a117c75.exe"
1⤵
PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 1704
  2⤵
  - Program crash
  PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3444 -ip 3444
1⤵
PID:872

memory/3444-1-0x00000000007B0000-0x00000000008B0000-memory.dmp

Filesize
1024KB

Download
memory/3444-2-0x00000000006F0000-0x0000000000720000-memory.dmp

Filesize
192KB

Download
memory/3444-3-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3444-5-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3444-7-0x00000000007B0000-0x00000000008B0000-memory.dmp

Filesize
1024KB

Download
memory/3444-8-0x00000000006F0000-0x0000000000720000-memory.dmp

Filesize
192KB

Download
memory/3444-9-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download