Overview

overview

10

Static

static

1

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.7z

  • Size

    13.5MB

  • Sample

    240913-nbwrkazbmc

  • MD5

    4d9ad7c00699115a773f8ad0f2df7a17

  • SHA1

    b69e4582f20195e70a8b631019bd391155c6c05d

  • SHA256

    f1197d378546d5c5c2fd88c0b08a16ef30dbad4b21a5c52ea6fc3f525878ac2e

  • SHA512

    f08ac37334b59ef5c6d50554b2ed8ba0b113a8c43fd4e25add05269a4b1530fa226d3b1dcd0b480ddd28f87ff057951a89a55a8c5d64da5be8eeecc4fdcbc66f

  • SSDEEP

    393216:ORc/IKa0RnnHcXP82IV3t2AjDxSHlr4NQxaFQMg4H:yKrnnHc/NM3tdDeKNQxYH

Score
10/10
vidarcredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      781.8MB

    • MD5

      777bd4bb111edb06c450a8125a2dc2c2

    • SHA1

      b7e815fcaee4026176fec94f7b9fd6107d46aab6

    • SHA256

      623e2a6cd3ba596c317e75ac41a7e73a196b41554553b999f4826af1a5e6c014

    • SHA512

      3c00cd516a137f5af370d9a86335e880ec9051679c0d681796f2967a2d8ece94b35b403f2204d2ef76e7b6dbc0e289875f8d4a1795fcbd90cf82b4a368cadafc

    • SSDEEP

      196608:kadEDbvzKLY6ZFdyUDsYqMo1HfilW2/MqCfb3QHIgz9MwOQ+JWE8UUQ:kxbvzRXUDDOKx/M3w50fwO

    Score
    10/10
    vidarcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Downloads MZ/PE file

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks