General

  • Target

    5a77b0ff2f1501e33ef85c5fc25cdbc4938c1b25e4177daa67bc0d9b786ecb31

  • Size

    554KB

  • Sample

    241001-yl145s1emf

  • MD5

    09b77f1874baa14206bbf2924df9288c

  • SHA1

    33a3a41e73f56cc40d15de3c6592cb339a567065

  • SHA256

    5a77b0ff2f1501e33ef85c5fc25cdbc4938c1b25e4177daa67bc0d9b786ecb31

  • SHA512

    282dcf9f44290da3cb474c4aca76bccf1f90409a6b6f07b8e903837e0d52ade8087e103800f974cf2c8326bf7f523cf294b444310b813cf6d0f35dceb83cf7ca

  • SSDEEP

    12288:RI7zgPouTUMb6m8TLYNBFTfLp+F7R4XY:WAV6B+LAFmXY

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Targets

    • Target

      5a77b0ff2f1501e33ef85c5fc25cdbc4938c1b25e4177daa67bc0d9b786ecb31

    • Size

      554KB

    • MD5

      09b77f1874baa14206bbf2924df9288c

    • SHA1

      33a3a41e73f56cc40d15de3c6592cb339a567065

    • SHA256

      5a77b0ff2f1501e33ef85c5fc25cdbc4938c1b25e4177daa67bc0d9b786ecb31

    • SHA512

      282dcf9f44290da3cb474c4aca76bccf1f90409a6b6f07b8e903837e0d52ade8087e103800f974cf2c8326bf7f523cf294b444310b813cf6d0f35dceb83cf7ca

    • SSDEEP

      12288:RI7zgPouTUMb6m8TLYNBFTfLp+F7R4XY:WAV6B+LAFmXY

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks