Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    4.9MB

  • Sample

    240707-f1ekksvbrk

  • MD5

    d76247ccc284aca758a9c6794f645fa0

  • SHA1

    d0aa8fc23f22e22db06756c8b291cd26ce7630be

  • SHA256

    eec7713439401d9fe0dc71c4165606f1b1abc12e3473369a33b0a24f2f7d2476

  • SHA512

    15875045afafb7a92f205af794fa16fa309a02e5caf55baa3ada976d0f847f7ec6d80c10849a51c229dd40253fc06c37f926158e266c2df193b3a00a5f33d2a2

  • SSDEEP

    49152:1AwVVnjv8T7GDH0uVGa/cHZWRn4YIeIaUuTq0veUgZV0pDFlcho5d6YBLfJhz:1PznjvPf4ZWV4YIBQrvN0MD8or66Xz

Score
10/10
stealcvidarspywarestealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/bu77un

https://steamcommunity.com/profiles/76561199730044335
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Targets

    • Target

      file.exe

    • Size

      4.9MB

    • MD5

      d76247ccc284aca758a9c6794f645fa0

    • SHA1

      d0aa8fc23f22e22db06756c8b291cd26ce7630be

    • SHA256

      eec7713439401d9fe0dc71c4165606f1b1abc12e3473369a33b0a24f2f7d2476

    • SHA512

      15875045afafb7a92f205af794fa16fa309a02e5caf55baa3ada976d0f847f7ec6d80c10849a51c229dd40253fc06c37f926158e266c2df193b3a00a5f33d2a2

    • SSDEEP

      49152:1AwVVnjv8T7GDH0uVGa/cHZWRn4YIeIaUuTq0veUgZV0pDFlcho5d6YBLfJhz:1PznjvPf4ZWV4YIBQrvN0MD8or66Xz

    Score
    10/10
    stealcvidarspywarestealer

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks