Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4cd4350d5e48264696b980cc329ed0c1809b14194894557672cbb4baec3feea

  • Size

    403KB

  • Sample

    240926-3ewcjawepg

  • MD5

    55a5f2beec3dd4e2e81bd8c88b231ede

  • SHA1

    ca181991974c87da13066a00750f01dc175ee258

  • SHA256

    f4cd4350d5e48264696b980cc329ed0c1809b14194894557672cbb4baec3feea

  • SHA512

    03171620055fe45e71e20c4e19f9612d918254b66f652b61d45c6be936d0e5e6aff75a31481ffd0350d41f803feb0177c1a5c78086cfb18564112c7341faaafb

  • SSDEEP

    12288:sqo8/oWTZ9KhJIkbG/BkxvGqbS/+q9Z3qI2uEO:ig19K7Ikkk9xbctZ3q4t

Score
10/10
vidar9bf5e431869643a2ac397d2dc0d687fbdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

9bf5e431869643a2ac397d2dc0d687fb

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      f4cd4350d5e48264696b980cc329ed0c1809b14194894557672cbb4baec3feea

    • Size

      403KB

    • MD5

      55a5f2beec3dd4e2e81bd8c88b231ede

    • SHA1

      ca181991974c87da13066a00750f01dc175ee258

    • SHA256

      f4cd4350d5e48264696b980cc329ed0c1809b14194894557672cbb4baec3feea

    • SHA512

      03171620055fe45e71e20c4e19f9612d918254b66f652b61d45c6be936d0e5e6aff75a31481ffd0350d41f803feb0177c1a5c78086cfb18564112c7341faaafb

    • SSDEEP

      12288:sqo8/oWTZ9KhJIkbG/BkxvGqbS/+q9Z3qI2uEO:ig19K7Ikkk9xbctZ3q4t

    Score
    10/10
    vidar9bf5e431869643a2ac397d2dc0d687fbdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks