Overview

overview

10

Static

static

1

JpNzLWAgHF_MrAnon.bat

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JpNzLWAgHF_MrAnon.bat

  • Size

    5.3MB

  • Sample

    240912-p87qrswcpq

  • MD5

    19b5c87c0b9852349096678f5e282023

  • SHA1

    4cb1080f90f68b65c8ebab9c2e7a8286640b3ac0

  • SHA256

    163edbe86835ef07b9248ee9516b136be05d5b3fd60479bfa81e3375f44eacc9

  • SHA512

    82d4e435057de7e938c7cee8695bc1e258b2352ae885c68f26a679c91793b16c353cc8440e706f4687c49990d3b936788acb253983c671ef09b1bb46bf90a4e4

  • SSDEEP

    49152:Ik2uYNfkQHyggm5Xve+n8gJgxk5kWsqO+Cgs4e5NUZAICDucSsjHaz4Dl0vBKF:B

Score
10/10
vidardiscoveryexecutionstealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Targets

    • Target

      JpNzLWAgHF_MrAnon.bat

    • Size

      5.3MB

    • MD5

      19b5c87c0b9852349096678f5e282023

    • SHA1

      4cb1080f90f68b65c8ebab9c2e7a8286640b3ac0

    • SHA256

      163edbe86835ef07b9248ee9516b136be05d5b3fd60479bfa81e3375f44eacc9

    • SHA512

      82d4e435057de7e938c7cee8695bc1e258b2352ae885c68f26a679c91793b16c353cc8440e706f4687c49990d3b936788acb253983c671ef09b1bb46bf90a4e4

    • SSDEEP

      49152:Ik2uYNfkQHyggm5Xve+n8gJgxk5kWsqO+Cgs4e5NUZAICDucSsjHaz4Dl0vBKF:B

    Score
    10/10
    vidardiscoveryexecutionstealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks