General

  • Target

    b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42.exe

  • Size

    594KB

  • Sample

    241010-mcr94ayhqp

  • MD5

    f275736a38a6b90825076e8d786ad5c5

  • SHA1

    c0d862ceab728736580f043316cdc099b2ab8924

  • SHA256

    b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42

  • SHA512

    b6662ee0426b45c5629808718613a687808deeaca692bb00d26ac5c9098b8a36a126ef80eca470db085aa5a84e38a9ee088a165cea821bf1226055a4fd842711

  • SSDEEP

    12288:Z23Df42FsPVesttHjpBKBmtvoYTjapYQIhtud8FpowFgXRo:Sz4xDTHt/tgYTjJQ0pXowWXR

Malware Config

Extracted

Family

vidar

Version

11

Botnet

2ee1445fc63bc20d0e7966867b13e0e1

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42.exe

    • Size

      594KB

    • MD5

      f275736a38a6b90825076e8d786ad5c5

    • SHA1

      c0d862ceab728736580f043316cdc099b2ab8924

    • SHA256

      b48eeab60494eb44d8d5ef10a87fd46ad1aa33fdcf7245efb636f69f2fd55f42

    • SHA512

      b6662ee0426b45c5629808718613a687808deeaca692bb00d26ac5c9098b8a36a126ef80eca470db085aa5a84e38a9ee088a165cea821bf1226055a4fd842711

    • SSDEEP

      12288:Z23Df42FsPVesttHjpBKBmtvoYTjapYQIhtud8FpowFgXRo:Sz4xDTHt/tgYTjJQ0pXowWXR

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks