Overview

overview

10

Static

static

3

#!NewFiile...up.exe

windows7-x64

10

#!NewFiile...up.exe

windows10-2004-x64

10

#!NewFiile...se.dll

windows7-x64

1

#!NewFiile...se.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...md.dll

windows7-x64

1

#!NewFiile...md.dll

windows10-2004-x64

1

#!NewFiile...h.pptx

windows7-x64

1

#!NewFiile...h.pptx

windows10-2004-x64

1

#!NewFiile...er.exe

windows7-x64

1

#!NewFiile...er.exe

windows10-2004-x64

1

#!NewFiile...40.dll

windows7-x64

1

#!NewFiile...40.dll

windows10-2004-x64

1

#!NewFiile...ib.dll

windows7-x64

1

#!NewFiile...ib.dll

windows10-2004-x64

1

#!NewFiile...er.exe

windows7-x64

1

#!NewFiile...er.exe

windows10-2004-x64

1

#!NewFiile...or.exe

windows7-x64

1

#!NewFiile...or.exe

windows10-2004-x64

1

#!NewFiile...st.dll

windows7-x64

1

#!NewFiile...st.dll

windows10-2004-x64

1

#!NewFiile...er.dll

windows7-x64

1

#!NewFiile...er.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

#!NewFiile...-0.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    9e6d7fb44cef0ce27fef5b478d8fd9339c4037b911002cb7cfb9c085c7b68068.rar
  • Size 19.7MB
  • Sample240502-caal6adf7w
  • SHA256 9e6d7fb44cef0ce27fef5b478d8fd9339c4037b911002cb7cfb9c085c7b68068
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
banloadvidar048d5e906358321b51376c6237a65c77downloaderdropperevasionpersistencestealertrojan

Malware Config

Extracted

Family

  • vidar

Botnet

  • 048d5e906358321b51376c6237a65c77

C2

  • https://redddog.xyz

  • https://steamcommunity.com/profiles/76561199677575543

  • https://t.me/snsb82

Attributes
  • profile_id_v2

    048d5e906358321b51376c6237a65c77

  • user_agent

    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Targets

    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/Setup.exe
    • Size 8.5MB
    • SHA256 9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    banloadvidar048d5e906358321b51376c6237a65c77downloaderdropperevasionpersistencestealertrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/acdbase.dll
    • Size 2.9MB
    • SHA256 cf8b85beeff99b13d06ed15c79e555ab74e30dfa1491a36c4332f54ed09887e4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-convert-l1-1-0.dll
    • Size 25KB
    • SHA256 ce6fcc2ddf21720c92bee04f5736a4787acffa970a1b0dbeea39ff5efec52c75
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-environment-l1-1-0.dll
    • Size 21KB
    • SHA256 fda46141c236a11054d4d3756a36da4412c82dd7877daad86cb65bf53d81ca1a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-heap-l1-1-0.dll
    • Size 21KB
    • SHA256 7617838af1b589f57e4fe9fee1e1412101878e6d3287cdc52a51cd03e3983717
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-runtime-l1-1-0.dll
    • Size 25KB
    • SHA256 b0e50572eb82a46ed499775e95bfde7cb25c498957432c18c20cf930f332efd0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-stdio-l1-1-0.dll
    • Size 25KB
    • SHA256 189d551fb3cba3dbb9b9c1797e127a52ac486d996f0ac7cba864fe35984a8d28
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral9
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-string-l1-1-0.dll
    • Size 25KB
    • SHA256 8b1471101145343da5f2c5981c515da4dfae783622ed71d40693fe59c3088d7a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-time-l1-1-0.dll
    • Size 21KB
    • SHA256 f41511e477a164eb9451ca51fb3810437f3b15f21e6f5c6ce0956e84ec823723
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/api-ms-win-crt-utility-l1-1-0.dll
    • Size 21KB
    • SHA256 f15af0db93d9385ff9d8efdc06aacd0729d0dfcb66e91ca0243bb160f2ed89d0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/libmmd.dll
    • Size 4.0MB
    • SHA256 e7500acfa41668f641e1272d17ff33a2924b5c6a3cf61686b50789d5ace51c33
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/stich.pptx
    • Size 82KB
    • SHA256 5c3ce1831ebf67eec26a6a0136562f7ed8e16a96ed34aca5d3412fb36239a163
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/updater.ini
    • Size 25KB
    • SHA256 b2c04a568ac068f8bb2214307e5616468e2a53dbfca9f57e2ab90d140bc29e1a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/vcruntime140.dll
    • Size 116KB
    • SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/AzureKeyVaultDgssLib.dll
    • Size 373KB
    • SHA256 3eee708fdcc68fe76ac4cc7adba90201912c63cd815717f91a5eabba1170af0d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/BugReporter
    • Size 521KB
    • SHA256 b8b06487ee2c2f2a4ae25d1e7a08a9ce831539a529fe2ed0e8841e5f7c42de90
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/ComExtractor
    • Size 618KB
    • SHA256 d66ee1d1e44feb03d7821062ce27e92da0fa78f7e47a451b7b1d4b94860dd309
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
    • Size 108KB
    • SHA256 98a87914e37600c7f97a27ca603a6b994dd51ffd390ce5b34e073939d258c2f4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/WinUiBootstrapper.dll
    • Size 896KB
    • SHA256 c0cfd5ecd4fa7c78eee91c4a2e7963e805513a88ad376772108b9b0c54bb8551
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/api-ms-win-core-console-l1-1-0.dll
    • Size 21KB
    • SHA256 03ffdb036329a25beacf905d62611a13e3dfdda6cbd2d13af830258e8cf40ec0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      #!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/x64/api-ms-win-core-console-l1-2-0.dll
    • Size 21KB
    • SHA256 449631a3f5fadef72acc2c2f84765208d0ca014ec1fe93fb9ad805eec1d40eae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

banloadvidar048d5e906358321b51376c6237a65c77downloaderdropperevasionpersistencestealertrojan
Score
10/10

behavioral2

banloadvidar048d5e906358321b51376c6237a65c77downloaderdropperevasionpersistencestealertrojan
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10