General

  • Target

    13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f

  • Size

    3.9MB

  • Sample

    240808-2f53paveng

  • MD5

    fee265f64791e63acdcd3e04acdc93b9

  • SHA1

    ce95f3b23180323579c9b7cdcc50fc16fceabcdf

  • SHA256

    13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f

  • SHA512

    5873c1d1c1b7362a5ce24cad8acb882baf4c8431617944db70224e9f8a9e1ce09256c37e39f80d31c4ab50ea6a9bd22e60b08823c943f7e73dc3c21c3f82b9ba

  • SSDEEP

    49152:BkMVEqXfvoOqoYqUPVK3tkhoUIL02aQxoRTLbvZgkxnM9iTRyiqy4:BJ9fAOqrd2acopv/2iohy4

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199747278259

https://t.me/armad2a

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36

Targets

    • Target

      13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f

    • Size

      3.9MB

    • MD5

      fee265f64791e63acdcd3e04acdc93b9

    • SHA1

      ce95f3b23180323579c9b7cdcc50fc16fceabcdf

    • SHA256

      13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f

    • SHA512

      5873c1d1c1b7362a5ce24cad8acb882baf4c8431617944db70224e9f8a9e1ce09256c37e39f80d31c4ab50ea6a9bd22e60b08823c943f7e73dc3c21c3f82b9ba

    • SSDEEP

      49152:BkMVEqXfvoOqoYqUPVK3tkhoUIL02aQxoRTLbvZgkxnM9iTRyiqy4:BJ9fAOqrd2acopv/2iohy4

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks