Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    4.0MB

  • Sample

    240708-pzl3pszbkk

  • MD5

    3d8c6425d1a2106f055331464e86c44c

  • SHA1

    5d511d67ab61ee5e3d57c05846979f2a4d4ae2dd

  • SHA256

    7228fcec0d053ae3cdc9aacc192c2dccf3c159211a44eb390608c586f013c65c

  • SHA512

    95b15bea9bb0ae90c90fe6659666bbcf59f2cb17fbf9de7ca348eb0f54706a839cf882c6de365ac45e0861f7677d1b79d88439e7c5f90359c6830828f8ae5fe6

  • SSDEEP

    98304:ed0I3rg8oRURlZ3uxd+lBb0v681D5/NP:ed0I3rgfkL35/k683/9

Score
10/10
stealcvidarspywarestealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/bu77un

https://steamcommunity.com/profiles/76561199730044335
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Targets

    • Target

      file.exe

    • Size

      4.0MB

    • MD5

      3d8c6425d1a2106f055331464e86c44c

    • SHA1

      5d511d67ab61ee5e3d57c05846979f2a4d4ae2dd

    • SHA256

      7228fcec0d053ae3cdc9aacc192c2dccf3c159211a44eb390608c586f013c65c

    • SHA512

      95b15bea9bb0ae90c90fe6659666bbcf59f2cb17fbf9de7ca348eb0f54706a839cf882c6de365ac45e0861f7677d1b79d88439e7c5f90359c6830828f8ae5fe6

    • SSDEEP

      98304:ed0I3rg8oRURlZ3uxd+lBb0v681D5/NP:ed0I3rgfkL35/k683/9

    Score
    10/10
    stealcvidarspywarestealer

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks