Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

  • Size

    2.8MB

  • Sample

    240425-a4w15scd7t

  • MD5

    7f1e688e77760ad29c560404a2fb9d2f

  • SHA1

    7c06e05c8e13d01df26653cbe12695af139c5854

  • SHA256

    086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

  • SHA512

    e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e

  • SSDEEP

    49152:lAfXmQ/GT5+pDEuOwHLHE83/G9+SbSyCfHtl8/ioefjKxAd2jVAeIXT:2+4GT0OSL04Dl8/gcAsJAeIj

Score
10/10
vidarzgratratstealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Targets

    • Target

      086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

    • Size

      2.8MB

    • MD5

      7f1e688e77760ad29c560404a2fb9d2f

    • SHA1

      7c06e05c8e13d01df26653cbe12695af139c5854

    • SHA256

      086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

    • SHA512

      e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e

    • SSDEEP

      49152:lAfXmQ/GT5+pDEuOwHLHE83/G9+SbSyCfHtl8/ioefjKxAd2jVAeIXT:2+4GT0OSL04Dl8/gcAsJAeIj

    Score
    10/10
    vidarzgratratstealer

    • Detect Vidar Stealer

      stealer

    • Detect ZGRat V1

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks