General

  • Target

    c1b3b50c6ab0ed4e6e453cd5762585cd10876007f4a2de76fb26f498350c92d7.exe

  • Size

    4.8MB

  • Sample

    240810-b4bwmszenk

  • MD5

    f3d762fb769f1b2bd26865e91466d473

  • SHA1

    11adc51a020062bfe97c5d0b0e8400c163d73bed

  • SHA256

    c1b3b50c6ab0ed4e6e453cd5762585cd10876007f4a2de76fb26f498350c92d7

  • SHA512

    b3debb1f56949e56785559591e9dd6877513e170a5311ef13856364703cdcc3f70b7b9dcf131d46c20f7d65feef507805ad89bd4469b2400e0323e3436e00607

  • SSDEEP

    49152:GXU7GvcT28J03pVikASp1vYpDbG2b2zjx9oeL5EmmHJju05aIAUXSjNJ:GXU7r03pViaEDbG2bo/tEmmju05HAGs

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199747278259

https://t.me/armad2a

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36

Targets

    • Target

      c1b3b50c6ab0ed4e6e453cd5762585cd10876007f4a2de76fb26f498350c92d7.exe

    • Size

      4.8MB

    • MD5

      f3d762fb769f1b2bd26865e91466d473

    • SHA1

      11adc51a020062bfe97c5d0b0e8400c163d73bed

    • SHA256

      c1b3b50c6ab0ed4e6e453cd5762585cd10876007f4a2de76fb26f498350c92d7

    • SHA512

      b3debb1f56949e56785559591e9dd6877513e170a5311ef13856364703cdcc3f70b7b9dcf131d46c20f7d65feef507805ad89bd4469b2400e0323e3436e00607

    • SSDEEP

      49152:GXU7GvcT28J03pVikASp1vYpDbG2b2zjx9oeL5EmmHJju05aIAUXSjNJ:GXU7r03pViaEDbG2bo/tEmmju05HAGs

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks