vidar

Sharing

Copy URL Twitter E-mail

General

Target
b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7.zip
Size 13.1MB
Sample240502-cfmtnsga97
SHA256 b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7
MD5 f74356e6d895188cc5b28c98d9305844
SHA1 3cd6ccd521608e07077db2ca48b6d3c4b64743f7
SHA512 f194a38a4f6f57ac098d666ce9e2915547b7802ef1f12b8a8a2db2399673b863347131daeef8fee3f790f2bb91ec520fe0a0d46422eb99f80debefc647095a66
SSDEEP 393216:DksKNizh3XEKomFeNLUFEK+wNT/DmRSSNQgFl+N:DONit3UKTeulFNHS+gFl+N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

https://redddog.xyz
https://steamcommunity.com/profiles/76561199677575543
https://t.me/snsb82

Attributes

profile_id_v2
f98c5b0a7dd3573ec9aac41b4a67f845
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Targets

- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe
- Size 938KB
- SHA256 bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
- MD5 b15bac961f62448c872e1dc6d3931016
- SHA1 1dcb61babb08fe5db711e379cb67335357a5db82
- SHA512 932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
- SSDEEP 24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vidar f98c5b0a7dd3573ec9aac41b4a67f845 stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/WCLDll.dll
- Size 590KB
- SHA256 218106e2f5ee44e8ae3ecf62e5c2cb1c3db50e5825f4737c9d13bbd48114ed0b
- MD5 47eee41b822d953c47434377006e01fe
- SHA1 ad42e88bbcce1640aeda1397f82c826ba764d08e
- SHA512 443328c44f0d4203c1d7ffc0cce0883c279db9a820e53c5ef4e4711fac451563b4f2ef114c21a4c947212def9f4218ef852ca0e9bfe8a8655668c757f591883f
- SSDEEP 12288:D+Se970XqzxUmUkVakh1d4wJjfXB7w86ywKUc6A9iSOJ7zP8cl7ksEjwxtuVOm4:He97qqzxXUkckh1d4wJjfB8vywKUc6Aw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/msvcp140.dll
- Size 427KB
- SHA256 fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
- MD5 71a0aa2d05e9174cefd568347bd9c70f
- SHA1 cb9247a0fa59e47f72df7d1752424b33a903bbb2
- SHA512 6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a
- SSDEEP 12288:bBsEzAVPIODrCdVgI7bwv674dOzhUgiW6QR7t5s03Ooc8dHkC2esy2n:9s8AVwOU7bwTdt03Ooc8dHkC2en2n
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/updater.ini
- Size 25KB
- SHA256 b2c04a568ac068f8bb2214307e5616468e2a53dbfca9f57e2ab90d140bc29e1a
- MD5 91e2d2af70ed5e2abdfa2df50fbfaf35
- SHA1 5d444597a4f6a46ea709b970ac8b117015685706
- SHA512 0fdc99d1adb18b39a101b4fb0b214b34534bcc616c142a985be1915825ed70426d2bfbbad3b0e227d4369f3de4ea2cace6f7e99f6e7b083cea3f91dd9d03f61d
- SSDEEP 384:5OzjkFGyyCMy8tS0HN05IPdSbdij7AhVc8l1ZxAzUtJBz07cJbU59FkGNGb5hiXQ:AC38tSY6ouwh8UUtJBz07/8riXiRn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/vcruntime140.dll
- Size 81KB
- SHA256 346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
- MD5 16b26bc43943531d7d7e379632ed4e63
- SHA1 565287de39649e59e653a3612478c2186096d70a
- SHA512 b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
- SSDEEP 1536:BDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzZoi:BF0ZQnm/oBab8y6mfe0vhuecbFWzZoi
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/AzureKeyVaultDgssLib.dll
- Size 373KB
- SHA256 3eee708fdcc68fe76ac4cc7adba90201912c63cd815717f91a5eabba1170af0d
- MD5 34ae0787cdfcb920753763251dcf83de
- SHA1 a41d5d58d21300e8418dbd354f46bba425fa9611
- SHA512 c8684bf3441fa5fb6a0e38df6bb9f728502e78f55eb9382ff168adab081440c37277497804fb1246a13e1f625aaa1858e39f62780c5c426edf3d825f9a739bc7
- SSDEEP 6144:UbJLUIAs2A/QRth5FMjvgQKMBTaJq+jqBTSMNGx6:UbJciQRth5FMjvg9MEJMFpGI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/BugReporter
- Size 521KB
- SHA256 b8b06487ee2c2f2a4ae25d1e7a08a9ce831539a529fe2ed0e8841e5f7c42de90
- MD5 29d33ee7f3fa0ee7f52ae96732c90f48
- SHA1 a781620a7bcff615d4dc64751b30287814200d13
- SHA512 7b0076d73dc6ed561b8294ed7687f5d0d285b080b2f12bc49623690e32ccd6a2161232860f906aa151f04950587befae49793130f5f6e2ff13453a401862d856
- SSDEEP 12288:pFU4ZwXnyWu9wHXspsSlxuw2xyJGS3mrxWI7n3OqiHThrmotbY7rSrZWZlJmwJIH:pyellxAxyJGS3mrxWI7n3OqiHThrmotD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/ComExtractor
- Size 618KB
- SHA256 d66ee1d1e44feb03d7821062ce27e92da0fa78f7e47a451b7b1d4b94860dd309
- MD5 36848dd965ff265d696fff4f2d51935e
- SHA1 68c6390741c490adf2802c84e06a3b90a3c308ea
- SHA512 6c3e9cdce928a78b9ea997954043ff82b2767a29b519116884e616b8aaa48668ccd051ed4607830bd7b59e32671e563939d180e576ae91752f854081b84b35af
- SSDEEP 12288:pRP0qhnnyfYZtOUdSK+jgsVGmzyg4J5EA:fP0DgsVzyJ5EA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
- Size 108KB
- SHA256 98a87914e37600c7f97a27ca603a6b994dd51ffd390ce5b34e073939d258c2f4
- MD5 1f4379d416af34033857bb439057cee0
- SHA1 a779714e9fe715aad9db2218a4b761ab77e873b9
- SHA512 cdaa3d8727e287eeaddfd58e04f292bd8daf7671a2942f99a023f31037cc8b76dce5c0566d6c0664b24403930bdd9396b27af208c313a28010e7eb9f850ba881
- SSDEEP 1536:WPiq7mAYLZ/kEglj55rEzGJT45rhh9esSTrXjnwVijXXyNGF1ZvLzmFiXxnBjYh2:6sxkEDGJk5rYk9Y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/WinUiBootstrapper.dll
- Size 896KB
- SHA256 c0cfd5ecd4fa7c78eee91c4a2e7963e805513a88ad376772108b9b0c54bb8551
- MD5 290538fceae682f2cfc3580e01fa7d28
- SHA1 12df9dc416d48f90a5ee5648abd1479dcc5dc327
- SHA512 089986cfe48fbdc889322796d5b5721b0c5065cfde72516e3fb35024bbe5c3ed098c6b7dc0c459af732f96bc2f67c95435f6d9cbcd8941ac18b83ee54b27321b
- SSDEEP 24576:MpiGSL76HSy+SqfyJFE0yD3VDPItrsRmPrAF6dGUO9T:Mpj2GHSy+SqfyJFE0yD3VDPIhsAPrA4Q
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 03ffdb036329a25beacf905d62611a13e3dfdda6cbd2d13af830258e8cf40ec0
- MD5 0909e61c8c9c717976828f65c987e5f9
- SHA1 b5affabb8afda55ebb1f404edab69c6c239affe6
- SHA512 7f78746e40da64631c08d0e173fbdeb40beed180932b42382d9f3ac0cdb4348d2a5b1c29770bb98f5d4823cfd66ecac2285afbcaf109f82c8b75c7711f10c49d
- SSDEEP 192:+OAWAhWeW4pICSjRof0cVWQ4GW/gYbOEU+9YX01k9z3AWB2c:+jWAhW82xlcdUOQGR9zBB2c
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-console-l1-2-0.dll
- Size 21KB
- SHA256 449631a3f5fadef72acc2c2f84765208d0ca014ec1fe93fb9ad805eec1d40eae
- MD5 6b33e6f1d77cec0901ea8e91473bc18b
- SHA1 a397d2c6aead0b3e57d413a8d4af7f28e67f4166
- SHA512 8f5214e38202719f6a7549b2b97ad24288974cfb6cf0da1e9eec5b3b2092220f2330a260b17e28afa90b90226666a765a4e64fe91107e2063cde8e285f64773b
- SSDEEP 192:p9qWAhWGW4pICSjRof0cVWQ4iWnYU7h+Il+jX01k9z3Az3TzRL:mWAhWk2xlcQtEjR9z83/RL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 d718e1b6c352112c2f8e36b4ba5ed28e6179257fd2fe944c4a0d404b5c15b5ae
- MD5 2b4a3a51e075ab9819c6d6bc40efb4b5
- SHA1 bc52c10ded8b087c73229dc2f98714b5a368f521
- SHA512 13b07dc2247d51dad1ab9bc7df93e0d3e1bd6cc4fd16f9aff87ceffd40a56933d569a5fb82177dea7b6ea04ebf9f909f95451d123126155a13de6a85f747c592
- SSDEEP 192:JWAhWSWCYtvnVWQ4WWd/q+KKnAX01k9z3Adaoy:JWAhWtCqTKAR9zsao
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-debug-l1-1-0.dll
- Size 21KB
- SHA256 f65b1b3ea2767f98f0c29118e85b06f4e61654bec34b60b3abb593b24ec29af4
- MD5 607703b245d9b4fc69a8b5363ff626fa
- SHA1 dcf4626787ea220b19e08cc5bf9e55553a3a2aef
- SHA512 92d761f733f2c678946894ca72459b0e6dc62cd3abe1073653104689ab48c19603e6e1109c07b2f110822b424430f22d112f87c629b99d0b3ccc16e179549628
- SSDEEP 192:YWAhW+W4pICSjRof0cVWQ4GWk2QYIN5vCX01k9z3AiRDZXobo:YWAhWc2xlcSbUJCR9zdRFX1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-errorhandling-l1-1-0.dll
- Size 21KB
- SHA256 a83af0f79abb5e5c818c6f38a38da80e531081f3255cb006ed4c29635cc0b9ce
- MD5 059129bae1776f03c59d3ba66a6f6dee
- SHA1 33b1dbcaba1d16eaf5413f1378119cecc1298724
- SHA512 6a7da7e58620bc1ce4b6d3cab1e0b746fc9fcf05a84d85931f845412301880786fbc63b31611d9442b5a1cfa72558966375ef14edc749473e2b7c988dd20b675
- SSDEEP 384:9f7xeiIFRWAhWWlReaLMB+6R9zqoHLdg5CG6:EFVros29zlacj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-fibers-l1-1-0.dll
- Size 21KB
- SHA256 9057131f628e547c14754d545140ad6544e64606358104da50841e9a1b03f442
- MD5 9fa3992f5dac5ea5dfa15b9669c68154
- SHA1 a453fb6c4064da8c01ad03a4ea3c0434efe82635
- SHA512 ad73f3952dda55cfaa6a0d6a0233df785650f5965caa4859b6c1577e3fbd6020e60b4b26338387690cc48b16a186d2b530708a71d2671ab17ee8904399de292f
- SSDEEP 192:nWAhWqW4pICSjRof0cVWQ4GWGjwUBuvdOEU+9YX01k9z3AWW9q7fUV:nWAhWg2xlc7BulOQGR9zBaqjE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l1-1-0.dll
- Size 25KB
- SHA256 99ed148ffbb35829480412dc64da6ad24dfabe2f9a0eff9ba1493455d7127677
- MD5 817f9a76b7eadc1226b006ccbdd38a11
- SHA1 8b81897cdd4d48befa389c1df2d0b887ffeb58cb
- SHA512 53d8b2561862c6b2465665d761612aaa8b7adc887058260fbf970aac0fb006317283ada01468b1e042fd9dd44def90451793afee297ed787086645cebce45cd2
- SSDEEP 192:1NtaNYPvVX8rFTsfWAhWBW4pICSjRof0cVWQ4aWJLk4xOEU+9YX01k9z3AWBwCy:rPvVXBWAhWn2xlckOQGR9zBBwb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l1-2-0.dll
- Size 21KB
- SHA256 d56eae93c55abdc8eb77d132777049634e28a9b59fd4b2101d51351546b984d1
- MD5 e334f2fe1e0e6d5d6966f139ed328d97
- SHA1 68b2cd826f3dfa59531397ebb3f382dec9af5fe5
- SHA512 fb6ee02f06447c906a4353d93ce247e14a9a1ea4255819a88e395afe2e3775fe3aeb622b7a97d86086d88c739ba4d2e2fba9e8fd6467e167fc75d595c9182327
- SSDEEP 192:hsIkWAhWW7WCYtvnVWQ4OW0mOOt5equ/X01k9z3AFpYlQ:h9kWAhWWCK56/R9zgWy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-file-l2-1-0.dll
- Size 21KB
- SHA256 9f496e181b1c862c7a7d03c09d9b0a5361535c98acbb1a9d50a27bcfb0a2bcc5
- MD5 7f0ef1cf592d04b082b65f75584652cd
- SHA1 f7b9a2851a66a6a8eb509f2541b6ccc3b551f2fa
- SHA512 30d2d695773e7bfd67de8691c40e571b3b91858e72eab3d78c84902b359108e9988247bf81689ab15fef6ed0a9ef62031f1937c6e7ce4ce8e1a34970ba23e727
- SSDEEP 192:iCuWAhWGkW4pICSjRof0cVWQ4iWwLuCFaqDu0K9X01k9z3ATd83:zuWAhW/2xlcuCFYj9R9zsdM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-handle-l1-1-0.dll
- Size 21KB
- SHA256 5e48c99dd6318b017686bde507cdcb9d6ecf25f4f78f345845b865e443f1ee66
- MD5 1902b85a588178857e9637902e5a1b85
- SHA1 31ae4cf76a34ccbd92fdbe60bee080998741ef4d
- SHA512 0755e9c0adc9e374060c851d4f7fa62633ec07dde0bbfd56ffc9bc8ecff5b9efd6fa8418c43e838770eed43a54a48fd61a41226d9ea84834275a4a36c7796472
- SSDEEP 192:jPWAhWWMhWCYtvnVWQ4OW8vpgVt5equ/X01k9z3AFpT46cuwY:jPWAhWWMAXp456/R9zg5Tcu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-heap-l1-1-0.dll
- Size 21KB
- SHA256 6070ffb5e20ed032d460d323df981d369fa68045fab130fd100803a00ab88c23
- MD5 892e47390f34aac7d20afe63ffa92f20
- SHA1 4a78a77ae1d5bdba55534167f781a3c8675c7ed3
- SHA512 8b37866ebdca5047673d984bd779b1df052e3d44e3fabc3a4ce2e747489baa2bd86add629d95c76cf08150f74281d89d46372ef64266b90304cf7dd581af3a93
- SSDEEP 192:UxlwWAhW8sW4pICSjRof0cVWQ4aWQVKbOEU+9YX01k9z3AWl9:UxlwWAhWV2xlccbOQGR9zBl9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31
- Target
  @#!!Newest_SoftWare_2024_P@SSCODE_%$/x64/api-ms-win-core-interlocked-l1-1-0.dll
- Size 21KB
- SHA256 4ea02b683513a157e21824b1c1e9ebb782d22f14209b67961f97b1f79673d3ed
- MD5 d8999e328af5ee1eb23c216336637cb7
- SHA1 a7bde6c833e4d6ddefcc4050997b1583ff1ffa42
- SHA512 4f041ed2daf781b7f86b4459e74330650b2687ee46dfb961ed7a0716ac7ad2082a631cb619cc6d3c7d19f550bc030553b9656aeba14f969dd52df0b40a0e418f
- SSDEEP 192:aDWAhW+W4pICSjRof0cVWQ4GWgQirmYIN5vCX01k9z3AiRYCj0+y:aDWAhWc2xlc1frJUJCR9zdRYn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32