General
-
Target
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2
-
Size
571KB
-
Sample
241010-b9zvnatgqe
-
MD5
9cf772fdf6bfeb30235fac5c81614720
-
SHA1
dd93629f08219ae337bc26c3f0250b0fa0051193
-
SHA256
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2
-
SHA512
e47925694932bcf1746b1499959fbca00ab100bd27f52a2def66532baea4e21a06f60db56b6137986705f798a65488d488d2d65d8b720ce2f14479a09d530249
-
SSDEEP
12288:yGoEhvQ9zceD4MFFJ36vaEfTPRZA75yILda4S:ywvQ6MZ3yvzvAFyIR
Static task
static1
Behavioral task
behavioral1
Sample
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2.exe
Resource
win10-20240611-en
Malware Config
Extracted
vidar
8ecc9c7eaebfdf2a8cc0586d7419d6ea
https://t.me/maslengdsa
https://steamcommunity.com/profiles/76561199786602107
https://t.me/lpnjoke
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Targets
-
-
Target
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2
-
Size
571KB
-
MD5
9cf772fdf6bfeb30235fac5c81614720
-
SHA1
dd93629f08219ae337bc26c3f0250b0fa0051193
-
SHA256
ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2
-
SHA512
e47925694932bcf1746b1499959fbca00ab100bd27f52a2def66532baea4e21a06f60db56b6137986705f798a65488d488d2d65d8b720ce2f14479a09d530249
-
SSDEEP
12288:yGoEhvQ9zceD4MFFJ36vaEfTPRZA75yILda4S:ywvQ6MZ3yvzvAFyIR
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-