Overview

overview

10

Static

static

3

S0FTWARE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S0FTWARE (2024).rar

  • Size

    21.4MB

  • Sample

    240930-hj8hfa1cqk

  • MD5

    d5916500ce26e12fdceb6bfb2998f805

  • SHA1

    7018f0c432e1d4fbda72d05372951f247881a0ab

  • SHA256

    cec9968a990c8bd808372b0d265ca2b37cb6145c79fdb86983bdfeeeb0735391

  • SHA512

    11a841355d36f4d8af213e394530858ebb54f6eeed1316efb972ed3d2131eb0880d71bbb7f6ebc80d17506c4b8612f6415e77fce998f830c059b73ad35e37f75

  • SSDEEP

    393216:TyOFeYz8rtSOb53cCyjU2zYdsPB2AuqCk/pSrhdx9PsQXmGPBJ/SzBhWNHSj5m:TyMkPFCQ2zYIIG/GhjhnXtPBczBX5m

Score
10/10
vidar346a77fbabba142b23c256004b5a7c5dcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

346a77fbabba142b23c256004b5a7c5d

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      S0FTWARE.exe

    • Size

      18.0MB

    • MD5

      a11bb3b18eba3f07561ca84c92c520cd

    • SHA1

      c09ffdaa9b11747b07e88f669c70566a48134678

    • SHA256

      7cfae4e35c049f4aad444cca84c5fcdd0f4da67b5a1846e821322a9f9757096b

    • SHA512

      108e8153f76adfb5eb840a771b5af0c80396838363add14e05baf1b953ae19a684bed0648c2b4404d23d2a8f9a0ad2968b2f3e6d6a062c462a217a75dd9a85ac

    • SSDEEP

      98304:NnBWTZ3ASa9wYqH4ALpq+yU0VhtDEH1EU/5VY2PJzuaIK:APa9wYqHZE40jtDEmU/5VPH

    Score
    10/10
    vidar346a77fbabba142b23c256004b5a7c5dcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks