vidar | a284b78805f86f37160f9aecf0f203361007b8541da5783bff73756ab4e3959f

Sharing

Copy URL

Twitter E-mail

General

Target

a284b78805f86f37160f9aecf0f203361007b8541da5783bff73756ab4e3959f
Size

2.3MB
MD5

7cd6be60420123a1f81ec5860c8f5dee
SHA1

f25d78a7ceab7521d882d26818a3eed42a7418d1
SHA256

a284b78805f86f37160f9aecf0f203361007b8541da5783bff73756ab4e3959f
SHA512

dd7b2aca051392afed330c437769cae3f5eb23ade19d7a614cc53b2007490ec3be66336099792e5cd38be9f2f429f03534d31f2924ea39c21b6510f805f945b7
SSDEEP

3072:WTflPf+8sptha5JuxyBhWZq9phbGN7Rqv3lfYi1MiUllrX:W5P2dzOJuxYQe4xYv1wi1M5bX

Score

10^/10

stealer 453a5f44680cb86f2de3dfd27c7e09cd vidar

Malware Config

Extracted

Family

vidar

Version

8.4

Botnet

453a5f44680cb86f2de3dfd27c7e09cd

https://steamcommunity.com/profiles/76561199654112719

https://t.me/r2d0s

Attributes

profile_id_v2
453a5f44680cb86f2de3dfd27c7e09cd
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Signatures

Detect Vidar Stealer 1 IoCs
stealer

Processes:

resource yara_rule

sample family_vidar_v7
Vidar family
vidar

resource	yara_rule
sample	family_vidar_v7

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
a284b78805f86f37160f9aecf0f203361007b8541da5783bff73756ab4e3959f

Files

a284b78805f86f37160f9aecf0f203361007b8541da5783bff73756ab4e3959f
.exe windows:5 windows x86 arch:x86

8178ed0c64de9ccabcaab8007468e585

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_EH_prolog
??_U@YAPAXI@Z
memcmp
__CxxFrameHandler3
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memmove
memchr
strlen
strtok_s
strcpy_s
strchr
memcpy
memset

kernel32

IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
ExitProcess
GetCurrentProcess
lstrlenA
lstrcatA
LocalAlloc
ReadProcessMemory
VirtualQueryEx
OpenProcess
FileTimeToSystemTime
CloseHandle
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
GetProcAddress
LoadLibraryA
HeapAlloc
VirtualAllocExNuma
HeapFree
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetModuleHandleW
SetLastError
GetCurrentThreadId

user32

CharToOemA

advapi32

RegOpenKeyExA
RegGetValueA
GetCurrentHwProfileA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

shlwapi

ord155

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

8178ed0c64de9ccabcaab8007468e585

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Sections

.text Size: 124KB - Virtual size: 124KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 2.1MB - Virtual size: 2.1MB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 124KB - Virtual size: 124KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 2.1MB - Virtual size: 2.1MB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 20KB - Virtual size: 20KB