vidar | 9f685df11e2b24e55ae610d8fe4f9ea005b8dba84d4de97be0cce7fc7ae3c5ca

Sharing

Copy URL

Twitter E-mail

General

Target

9f685df11e2b24e55ae610d8fe4f9ea005b8dba84d4de97be0cce7fc7ae3c5ca
Size

208KB
MD5

9ec7f08c85bfa1b267761f225b68ab0b
SHA1

8b11b85782a3d967c7461ced5abf0827587638ca
SHA256

9f685df11e2b24e55ae610d8fe4f9ea005b8dba84d4de97be0cce7fc7ae3c5ca
SHA512

3f363a9339d92dfb789fd9005806e6008cee922838769bd15be83ede0adb50bf332230762700f784b05d5cf32f72e5a9e7611d528c4666d7819f5272c84b1b31
SSDEEP

3072:AZWAfSR9CehJX4rRUiAPukFhm8qfuDUM41wvnFsocOHYpk5GK+lGjCQYpY:WDEBbAUUkFhfDs1w/uFrYjCQYp

Score

10^/10

stealer 3a0d6ef1ba365424eb0cabf120891041 vidar

Malware Config

Extracted

Family

vidar

Version

9.2

Botnet

3a0d6ef1ba365424eb0cabf120891041

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

profile_id_v2
3a0d6ef1ba365424eb0cabf120891041
user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f685df11e2b24e55ae610d8fe4f9ea005b8dba84d4de97be0cce7fc7ae3c5ca

Files

9f685df11e2b24e55ae610d8fe4f9ea005b8dba84d4de97be0cce7fc7ae3c5ca
.exe windows:5 windows x86 arch:x86

554d949fd335dd5958de0342706fbbec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strlen
__CxxFrameHandler3
memcmp
strcmp
??_U@YAPAXI@Z
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memmove
memchr
strtok_s
strcpy_s
strchr
memcpy
memset

kernel32

IsProcessorFeaturePresent
ExitProcess
GetCurrentProcess
LocalAlloc
ReadProcessMemory
VirtualQueryEx
OpenProcess
FileTimeToSystemTime
CloseHandle
CreateDirectoryA
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
GetProcAddress
LoadLibraryA
HeapAlloc
HeapFree
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetModuleHandleW
SetLastError
GetCurrentThreadId

user32

CharToOemA

advapi32

RegOpenKeyExA
RegGetValueA
GetCurrentHwProfileA

shell32

SHFileOperationA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

ord155

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

554d949fd335dd5958de0342706fbbec

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 137KB - Virtual size: 136KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 2.1MB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 137KB - Virtual size: 136KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 2.1MB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 21KB - Virtual size: 20KB