General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHZRcTA3SmlJc2pqZ1VmU2FGbVdSZURpWnpDd3xBQ3Jtc0tuZHpIUFdkMFprOWU0V21kZTZVQW5sQmtKeHpFNE0yZndMMUpaSlZpUEI3UC13eUtGbVg5WjlCTzF1dWVRYW03X0d4ak9uQlp6UmMxYjZDWjU0RG9aNENNSUpDRlhqd2JyTzBBQTBXeGxyQzJIUTAzdw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3is42kz6mwjhj%2FFiles&v=TQwLcwFTkl0
-
Sample
241005-v64h8axgqk
Malware Config
Extracted
vidar
11
346a77fbabba142b23c256004b5a7c5d
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHZRcTA3SmlJc2pqZ1VmU2FGbVdSZURpWnpDd3xBQ3Jtc0tuZHpIUFdkMFprOWU0V21kZTZVQW5sQmtKeHpFNE0yZndMMUpaSlZpUEI3UC13eUtGbVg5WjlCTzF1dWVRYW03X0d4ak9uQlp6UmMxYjZDWjU0RG9aNENNSUpDRlhqd2JyTzBBQTBXeGxyQzJIUTAzdw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3is42kz6mwjhj%2FFiles&v=TQwLcwFTkl0
Score10/10-
Detect Vidar Stealer
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-