Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf41950c2b87050f69bbcb6cb810e990d9a1f60a7109e8a3ba4668f2e397db96

  • Size

    401KB

  • Sample

    240926-2624qashjr

  • MD5

    5f1ea69f876e6c0b3f52c49cb56a5933

  • SHA1

    25efa25249943f752eb980d33a9945f126310fa9

  • SHA256

    bf41950c2b87050f69bbcb6cb810e990d9a1f60a7109e8a3ba4668f2e397db96

  • SHA512

    b6636579c7ef7b18e65bbf331527e3069c3b3c403fc21744f1692f1f882dc2e67ebc4c003ca857b2fa460fcc9e078f6c4dbbb1205d232f198e8046c7036dd2b3

  • SSDEEP

    12288:DuSEc/XKSAotoNQQGqlWAmyF0x3EGXY0kD:DIcPKTotHQ5Wzp5SD

Score
10/10
vidarb438a316528fda660b5e4e28911b77a1discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

b438a316528fda660b5e4e28911b77a1

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      bf41950c2b87050f69bbcb6cb810e990d9a1f60a7109e8a3ba4668f2e397db96

    • Size

      401KB

    • MD5

      5f1ea69f876e6c0b3f52c49cb56a5933

    • SHA1

      25efa25249943f752eb980d33a9945f126310fa9

    • SHA256

      bf41950c2b87050f69bbcb6cb810e990d9a1f60a7109e8a3ba4668f2e397db96

    • SHA512

      b6636579c7ef7b18e65bbf331527e3069c3b3c403fc21744f1692f1f882dc2e67ebc4c003ca857b2fa460fcc9e078f6c4dbbb1205d232f198e8046c7036dd2b3

    • SSDEEP

      12288:DuSEc/XKSAotoNQQGqlWAmyF0x3EGXY0kD:DIcPKTotHQ5Wzp5SD

    Score
    10/10
    vidarb438a316528fda660b5e4e28911b77a1discoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks