Overview

overview

10

Static

static

1

8bb86c8dcf...c5.exe

windows7-x64

10

8bb86c8dcf...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bb86c8dcf1a9a4870e5f659b472f4826a05d8d6f7234658a8e8903c284ac4c5

  • Size

    559KB

  • Sample

    241004-w5c6batemd

  • MD5

    cc58463069fb1c5b47270fc6e4b41400

  • SHA1

    1c5ac9d2ecb70e0fe5f32172de422b26bd243289

  • SHA256

    8bb86c8dcf1a9a4870e5f659b472f4826a05d8d6f7234658a8e8903c284ac4c5

  • SHA512

    faa949c89049649a82d381aa65b370fe8d9557c175f6771c91c7658b3fa95dc5d1ebebe3751bc51d55f1f9b2e90bf7ce5b03fe22224e7934c3f5eadba55dda2e

  • SSDEEP

    12288:JFdmQisJRpBNx7PAbhjIB6ZjNDumjkz9H5ijhIGx0ruSz2VPuEO:B7RTvzAF8B6FNDV2hEjhIG4uS0ut

Score
10/10
vidardiscoverystealer

Malware Config

Extracted

Family

vidar

C2

http://proxy.johnmccrea.com/

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      8bb86c8dcf1a9a4870e5f659b472f4826a05d8d6f7234658a8e8903c284ac4c5

    • Size

      559KB

    • MD5

      cc58463069fb1c5b47270fc6e4b41400

    • SHA1

      1c5ac9d2ecb70e0fe5f32172de422b26bd243289

    • SHA256

      8bb86c8dcf1a9a4870e5f659b472f4826a05d8d6f7234658a8e8903c284ac4c5

    • SHA512

      faa949c89049649a82d381aa65b370fe8d9557c175f6771c91c7658b3fa95dc5d1ebebe3751bc51d55f1f9b2e90bf7ce5b03fe22224e7934c3f5eadba55dda2e

    • SSDEEP

      12288:JFdmQisJRpBNx7PAbhjIB6ZjNDumjkz9H5ijhIGx0ruSz2VPuEO:B7RTvzAF8B6FNDV2hEjhIG4uS0ut

    Score
    10/10
    vidardiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks