Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2

  • Size

    571KB

  • Sample

    241010-b9zvnatgqe

  • MD5

    9cf772fdf6bfeb30235fac5c81614720

  • SHA1

    dd93629f08219ae337bc26c3f0250b0fa0051193

  • SHA256

    ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2

  • SHA512

    e47925694932bcf1746b1499959fbca00ab100bd27f52a2def66532baea4e21a06f60db56b6137986705f798a65488d488d2d65d8b720ce2f14479a09d530249

  • SSDEEP

    12288:yGoEhvQ9zceD4MFFJ36vaEfTPRZA75yILda4S:ywvQ6MZ3yvzvAFyIR

Score
10/10
vidar8ecc9c7eaebfdf2a8cc0586d7419d6eacredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Botnet

8ecc9c7eaebfdf2a8cc0586d7419d6ea

C2

https://t.me/maslengdsa

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2

    • Size

      571KB

    • MD5

      9cf772fdf6bfeb30235fac5c81614720

    • SHA1

      dd93629f08219ae337bc26c3f0250b0fa0051193

    • SHA256

      ae66a9bb78b38d759f7344b4b8429beffef795e21a73be7d657b26ba718c94e2

    • SHA512

      e47925694932bcf1746b1499959fbca00ab100bd27f52a2def66532baea4e21a06f60db56b6137986705f798a65488d488d2d65d8b720ce2f14479a09d530249

    • SSDEEP

      12288:yGoEhvQ9zceD4MFFJ36vaEfTPRZA75yILda4S:ywvQ6MZ3yvzvAFyIR

    Score
    10/10
    vidar8ecc9c7eaebfdf2a8cc0586d7419d6eacredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks