General

  • Target

    b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7.zip

  • Size

    13.1MB

  • Sample

    240502-cfmtnsga97

  • MD5

    f74356e6d895188cc5b28c98d9305844

  • SHA1

    3cd6ccd521608e07077db2ca48b6d3c4b64743f7

  • SHA256

    b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7

  • SHA512

    f194a38a4f6f57ac098d666ce9e2915547b7802ef1f12b8a8a2db2399673b863347131daeef8fee3f790f2bb91ec520fe0a0d46422eb99f80debefc647095a66

  • SSDEEP

    393216:DksKNizh3XEKomFeNLUFEK+wNT/DmRSSNQgFl+N:DONit3UKTeulFNHS+gFl+N

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

C2

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes
  • profile_id_v2

    f98c5b0a7dd3573ec9aac41b4a67f845

  • user_agent

    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Targets

    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe

    • Size

      938KB

    • MD5

      b15bac961f62448c872e1dc6d3931016

    • SHA1

      1dcb61babb08fe5db711e379cb67335357a5db82

    • SHA256

      bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5

    • SHA512

      932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370

    • SSDEEP

      24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Suspicious use of SetThreadContext

    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/WCLDll.dll

    • Size

      590KB

    • MD5

      47eee41b822d953c47434377006e01fe

    • SHA1

      ad42e88bbcce1640aeda1397f82c826ba764d08e

    • SHA256

      218106e2f5ee44e8ae3ecf62e5c2cb1c3db50e5825f4737c9d13bbd48114ed0b

    • SHA512

      443328c44f0d4203c1d7ffc0cce0883c279db9a820e53c5ef4e4711fac451563b4f2ef114c21a4c947212def9f4218ef852ca0e9bfe8a8655668c757f591883f

    • SSDEEP

      12288:D+Se970XqzxUmUkVakh1d4wJjfXB7w86ywKUc6A9iSOJ7zP8cl7ksEjwxtuVOm4:He97qqzxXUkckh1d4wJjfB8vywKUc6Aw

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/msvcp140.dll

    • Size

      427KB

    • MD5

      71a0aa2d05e9174cefd568347bd9c70f

    • SHA1

      cb9247a0fa59e47f72df7d1752424b33a903bbb2

    • SHA256

      fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47

    • SHA512

      6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a

    • SSDEEP

      12288:bBsEzAVPIODrCdVgI7bwv674dOzhUgiW6QR7t5s03Ooc8dHkC2esy2n:9s8AVwOU7bwTdt03Ooc8dHkC2en2n

    Score
    3/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/updater.ini

    • Size

      25KB

    • MD5

      91e2d2af70ed5e2abdfa2df50fbfaf35

    • SHA1

      5d444597a4f6a46ea709b970ac8b117015685706

    • SHA256

      b2c04a568ac068f8bb2214307e5616468e2a53dbfca9f57e2ab90d140bc29e1a

    • SHA512

      0fdc99d1adb18b39a101b4fb0b214b34534bcc616c142a985be1915825ed70426d2bfbbad3b0e227d4369f3de4ea2cace6f7e99f6e7b083cea3f91dd9d03f61d

    • SSDEEP

      384:5OzjkFGyyCMy8tS0HN05IPdSbdij7AhVc8l1ZxAzUtJBz07cJbU59FkGNGb5hiXQ:AC38tSY6ouwh8UUtJBz07/8riXiRn

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/vcruntime140.dll

    • Size

      81KB

    • MD5

      16b26bc43943531d7d7e379632ed4e63

    • SHA1

      565287de39649e59e653a3612478c2186096d70a

    • SHA256

      346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517

    • SHA512

      b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc

    • SSDEEP

      1536:BDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzZoi:BF0ZQnm/oBab8y6mfe0vhuecbFWzZoi

    Score
    3/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/AzureKeyVaultDgssLib.dll

    • Size

      373KB

    • MD5

      34ae0787cdfcb920753763251dcf83de

    • SHA1

      a41d5d58d21300e8418dbd354f46bba425fa9611

    • SHA256

      3eee708fdcc68fe76ac4cc7adba90201912c63cd815717f91a5eabba1170af0d

    • SHA512

      c8684bf3441fa5fb6a0e38df6bb9f728502e78f55eb9382ff168adab081440c37277497804fb1246a13e1f625aaa1858e39f62780c5c426edf3d825f9a739bc7

    • SSDEEP

      6144:UbJLUIAs2A/QRth5FMjvgQKMBTaJq+jqBTSMNGx6:UbJciQRth5FMjvg9MEJMFpGI

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/BugReporter

    • Size

      521KB

    • MD5

      29d33ee7f3fa0ee7f52ae96732c90f48

    • SHA1

      a781620a7bcff615d4dc64751b30287814200d13

    • SHA256

      b8b06487ee2c2f2a4ae25d1e7a08a9ce831539a529fe2ed0e8841e5f7c42de90

    • SHA512

      7b0076d73dc6ed561b8294ed7687f5d0d285b080b2f12bc49623690e32ccd6a2161232860f906aa151f04950587befae49793130f5f6e2ff13453a401862d856

    • SSDEEP

      12288:pFU4ZwXnyWu9wHXspsSlxuw2xyJGS3mrxWI7n3OqiHThrmotbY7rSrZWZlJmwJIH:pyellxAxyJGS3mrxWI7n3OqiHThrmotD

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/ComExtractor

    • Size

      618KB

    • MD5

      36848dd965ff265d696fff4f2d51935e

    • SHA1

      68c6390741c490adf2802c84e06a3b90a3c308ea

    • SHA256

      d66ee1d1e44feb03d7821062ce27e92da0fa78f7e47a451b7b1d4b94860dd309

    • SHA512

      6c3e9cdce928a78b9ea997954043ff82b2767a29b519116884e616b8aaa48668ccd051ed4607830bd7b59e32671e563939d180e576ae91752f854081b84b35af

    • SSDEEP

      12288:pRP0qhnnyfYZtOUdSK+jgsVGmzyg4J5EA:fP0DgsVzyJ5EA

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll

    • Size

      108KB

    • MD5

      1f4379d416af34033857bb439057cee0

    • SHA1

      a779714e9fe715aad9db2218a4b761ab77e873b9

    • SHA256

      98a87914e37600c7f97a27ca603a6b994dd51ffd390ce5b34e073939d258c2f4

    • SHA512

      cdaa3d8727e287eeaddfd58e04f292bd8daf7671a2942f99a023f31037cc8b76dce5c0566d6c0664b24403930bdd9396b27af208c313a28010e7eb9f850ba881

    • SSDEEP

      1536:WPiq7mAYLZ/kEglj55rEzGJT45rhh9esSTrXjnwVijXXyNGF1ZvLzmFiXxnBjYh2:6sxkEDGJk5rYk9Y

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/WinUiBootstrapper.dll

    • Size

      896KB

    • MD5

      290538fceae682f2cfc3580e01fa7d28

    • SHA1

      12df9dc416d48f90a5ee5648abd1479dcc5dc327

    • SHA256

      c0cfd5ecd4fa7c78eee91c4a2e7963e805513a88ad376772108b9b0c54bb8551

    • SHA512

      089986cfe48fbdc889322796d5b5721b0c5065cfde72516e3fb35024bbe5c3ed098c6b7dc0c459af732f96bc2f67c95435f6d9cbcd8941ac18b83ee54b27321b

    • SSDEEP

      24576:MpiGSL76HSy+SqfyJFE0yD3VDPItrsRmPrAF6dGUO9T:Mpj2GHSy+SqfyJFE0yD3VDPIhsAPrA4Q

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-console-l1-1-0.dll

    • Size

      21KB

    • MD5

      0909e61c8c9c717976828f65c987e5f9

    • SHA1

      b5affabb8afda55ebb1f404edab69c6c239affe6

    • SHA256

      03ffdb036329a25beacf905d62611a13e3dfdda6cbd2d13af830258e8cf40ec0

    • SHA512

      7f78746e40da64631c08d0e173fbdeb40beed180932b42382d9f3ac0cdb4348d2a5b1c29770bb98f5d4823cfd66ecac2285afbcaf109f82c8b75c7711f10c49d

    • SSDEEP

      192:+OAWAhWeW4pICSjRof0cVWQ4GW/gYbOEU+9YX01k9z3AWB2c:+jWAhW82xlcdUOQGR9zBB2c

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-console-l1-2-0.dll

    • Size

      21KB

    • MD5

      6b33e6f1d77cec0901ea8e91473bc18b

    • SHA1

      a397d2c6aead0b3e57d413a8d4af7f28e67f4166

    • SHA256

      449631a3f5fadef72acc2c2f84765208d0ca014ec1fe93fb9ad805eec1d40eae

    • SHA512

      8f5214e38202719f6a7549b2b97ad24288974cfb6cf0da1e9eec5b3b2092220f2330a260b17e28afa90b90226666a765a4e64fe91107e2063cde8e285f64773b

    • SSDEEP

      192:p9qWAhWGW4pICSjRof0cVWQ4iWnYU7h+Il+jX01k9z3Az3TzRL:mWAhWk2xlcQtEjR9z83/RL

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-datetime-l1-1-0.dll

    • Size

      21KB

    • MD5

      2b4a3a51e075ab9819c6d6bc40efb4b5

    • SHA1

      bc52c10ded8b087c73229dc2f98714b5a368f521

    • SHA256

      d718e1b6c352112c2f8e36b4ba5ed28e6179257fd2fe944c4a0d404b5c15b5ae

    • SHA512

      13b07dc2247d51dad1ab9bc7df93e0d3e1bd6cc4fd16f9aff87ceffd40a56933d569a5fb82177dea7b6ea04ebf9f909f95451d123126155a13de6a85f747c592

    • SSDEEP

      192:JWAhWSWCYtvnVWQ4WWd/q+KKnAX01k9z3Adaoy:JWAhWtCqTKAR9zsao

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-debug-l1-1-0.dll

    • Size

      21KB

    • MD5

      607703b245d9b4fc69a8b5363ff626fa

    • SHA1

      dcf4626787ea220b19e08cc5bf9e55553a3a2aef

    • SHA256

      f65b1b3ea2767f98f0c29118e85b06f4e61654bec34b60b3abb593b24ec29af4

    • SHA512

      92d761f733f2c678946894ca72459b0e6dc62cd3abe1073653104689ab48c19603e6e1109c07b2f110822b424430f22d112f87c629b99d0b3ccc16e179549628

    • SSDEEP

      192:YWAhW+W4pICSjRof0cVWQ4GWk2QYIN5vCX01k9z3AiRDZXobo:YWAhWc2xlcSbUJCR9zdRFX1

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-errorhandling-l1-1-0.dll

    • Size

      21KB

    • MD5

      059129bae1776f03c59d3ba66a6f6dee

    • SHA1

      33b1dbcaba1d16eaf5413f1378119cecc1298724

    • SHA256

      a83af0f79abb5e5c818c6f38a38da80e531081f3255cb006ed4c29635cc0b9ce

    • SHA512

      6a7da7e58620bc1ce4b6d3cab1e0b746fc9fcf05a84d85931f845412301880786fbc63b31611d9442b5a1cfa72558966375ef14edc749473e2b7c988dd20b675

    • SSDEEP

      384:9f7xeiIFRWAhWWlReaLMB+6R9zqoHLdg5CG6:EFVros29zlacj

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-fibers-l1-1-0.dll

    • Size

      21KB

    • MD5

      9fa3992f5dac5ea5dfa15b9669c68154

    • SHA1

      a453fb6c4064da8c01ad03a4ea3c0434efe82635

    • SHA256

      9057131f628e547c14754d545140ad6544e64606358104da50841e9a1b03f442

    • SHA512

      ad73f3952dda55cfaa6a0d6a0233df785650f5965caa4859b6c1577e3fbd6020e60b4b26338387690cc48b16a186d2b530708a71d2671ab17ee8904399de292f

    • SSDEEP

      192:nWAhWqW4pICSjRof0cVWQ4GWGjwUBuvdOEU+9YX01k9z3AWW9q7fUV:nWAhWg2xlc7BulOQGR9zBaqjE

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l1-1-0.dll

    • Size

      25KB

    • MD5

      817f9a76b7eadc1226b006ccbdd38a11

    • SHA1

      8b81897cdd4d48befa389c1df2d0b887ffeb58cb

    • SHA256

      99ed148ffbb35829480412dc64da6ad24dfabe2f9a0eff9ba1493455d7127677

    • SHA512

      53d8b2561862c6b2465665d761612aaa8b7adc887058260fbf970aac0fb006317283ada01468b1e042fd9dd44def90451793afee297ed787086645cebce45cd2

    • SSDEEP

      192:1NtaNYPvVX8rFTsfWAhWBW4pICSjRof0cVWQ4aWJLk4xOEU+9YX01k9z3AWBwCy:rPvVXBWAhWn2xlckOQGR9zBBwb

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l1-2-0.dll

    • Size

      21KB

    • MD5

      e334f2fe1e0e6d5d6966f139ed328d97

    • SHA1

      68b2cd826f3dfa59531397ebb3f382dec9af5fe5

    • SHA256

      d56eae93c55abdc8eb77d132777049634e28a9b59fd4b2101d51351546b984d1

    • SHA512

      fb6ee02f06447c906a4353d93ce247e14a9a1ea4255819a88e395afe2e3775fe3aeb622b7a97d86086d88c739ba4d2e2fba9e8fd6467e167fc75d595c9182327

    • SSDEEP

      192:hsIkWAhWW7WCYtvnVWQ4OW0mOOt5equ/X01k9z3AFpYlQ:h9kWAhWWCK56/R9zgWy

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l2-1-0.dll

    • Size

      21KB

    • MD5

      7f0ef1cf592d04b082b65f75584652cd

    • SHA1

      f7b9a2851a66a6a8eb509f2541b6ccc3b551f2fa

    • SHA256

      9f496e181b1c862c7a7d03c09d9b0a5361535c98acbb1a9d50a27bcfb0a2bcc5

    • SHA512

      30d2d695773e7bfd67de8691c40e571b3b91858e72eab3d78c84902b359108e9988247bf81689ab15fef6ed0a9ef62031f1937c6e7ce4ce8e1a34970ba23e727

    • SSDEEP

      192:iCuWAhWGkW4pICSjRof0cVWQ4iWwLuCFaqDu0K9X01k9z3ATd83:zuWAhW/2xlcuCFYj9R9zsdM

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-handle-l1-1-0.dll

    • Size

      21KB

    • MD5

      1902b85a588178857e9637902e5a1b85

    • SHA1

      31ae4cf76a34ccbd92fdbe60bee080998741ef4d

    • SHA256

      5e48c99dd6318b017686bde507cdcb9d6ecf25f4f78f345845b865e443f1ee66

    • SHA512

      0755e9c0adc9e374060c851d4f7fa62633ec07dde0bbfd56ffc9bc8ecff5b9efd6fa8418c43e838770eed43a54a48fd61a41226d9ea84834275a4a36c7796472

    • SSDEEP

      192:jPWAhWWMhWCYtvnVWQ4OW8vpgVt5equ/X01k9z3AFpT46cuwY:jPWAhWWMAXp456/R9zg5Tcu

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-heap-l1-1-0.dll

    • Size

      21KB

    • MD5

      892e47390f34aac7d20afe63ffa92f20

    • SHA1

      4a78a77ae1d5bdba55534167f781a3c8675c7ed3

    • SHA256

      6070ffb5e20ed032d460d323df981d369fa68045fab130fd100803a00ab88c23

    • SHA512

      8b37866ebdca5047673d984bd779b1df052e3d44e3fabc3a4ce2e747489baa2bd86add629d95c76cf08150f74281d89d46372ef64266b90304cf7dd581af3a93

    • SSDEEP

      192:UxlwWAhW8sW4pICSjRof0cVWQ4aWQVKbOEU+9YX01k9z3AWl9:UxlwWAhWV2xlccbOQGR9zBl9

    Score
    1/10
    • Target

      @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-interlocked-l1-1-0.dll

    • Size

      21KB

    • MD5

      d8999e328af5ee1eb23c216336637cb7

    • SHA1

      a7bde6c833e4d6ddefcc4050997b1583ff1ffa42

    • SHA256

      4ea02b683513a157e21824b1c1e9ebb782d22f14209b67961f97b1f79673d3ed

    • SHA512

      4f041ed2daf781b7f86b4459e74330650b2687ee46dfb961ed7a0716ac7ad2082a631cb619cc6d3c7d19f550bc030553b9656aeba14f969dd52df0b40a0e418f

    • SSDEEP

      192:aDWAhW+W4pICSjRof0cVWQ4GWgQirmYIN5vCX01k9z3AiRYCj0+y:aDWAhWc2xlc1frJUJCR9zdRYn

    Score
    1/10

MITRE ATT&CK Matrix

Tasks

static1

Score
3/10

behavioral1

vidarf98c5b0a7dd3573ec9aac41b4a67f845stealer
Score
10/10

behavioral2

vidarf98c5b0a7dd3573ec9aac41b4a67f845stealer
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10