Overview

overview

10

Static

static

1

08111bef3a...61.exe

windows7-x64

10

08111bef3a...61.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08111bef3ab8fbae5493a1c03502cb61.exe

  • Size

    580KB

  • Sample

    241007-qt4agaxfkr

  • MD5

    08111bef3ab8fbae5493a1c03502cb61

  • SHA1

    5022d59e2ee31a6e88ff093e94e4709897a6b53a

  • SHA256

    e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b

  • SHA512

    c875262e2bb6c9dd671c7a3ab08170ca02ca40191a9f41f730c41c2be3efa58179c4335eecfbd733bd34f004cbff23d746684ed97af2a04995b7931c95cd2537

  • SSDEEP

    12288:7goEhvQ9zc3c+IE5zkuzwlI8fH4pR0CO8SANRz5AYx4SDEO:7+vQz+NkO8fH8bSArzqpMt

Score
10/10
vidarcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

C2

http://lade.petperfectcare.com:80

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      08111bef3ab8fbae5493a1c03502cb61.exe

    • Size

      580KB

    • MD5

      08111bef3ab8fbae5493a1c03502cb61

    • SHA1

      5022d59e2ee31a6e88ff093e94e4709897a6b53a

    • SHA256

      e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b

    • SHA512

      c875262e2bb6c9dd671c7a3ab08170ca02ca40191a9f41f730c41c2be3efa58179c4335eecfbd733bd34f004cbff23d746684ed97af2a04995b7931c95cd2537

    • SSDEEP

      12288:7goEhvQ9zc3c+IE5zkuzwlI8fH4pR0CO8SANRz5AYx4SDEO:7+vQz+NkO8fH8bSArzqpMt

    Score
    10/10
    vidarcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks