General

  • Target

    7c2764544257198689376324bd69d64f2f296e9aa04d0b81363235aaa27e86d1N

  • Size

    580KB

  • Sample

    241010-mxybvatgpf

  • MD5

    43752727d461b7e277347bcc3bb4e330

  • SHA1

    0b5b574edd10e49fb2eeab54a465a1bdc8be358c

  • SHA256

    7c2764544257198689376324bd69d64f2f296e9aa04d0b81363235aaa27e86d1

  • SHA512

    24553f5eccfe865e1ed0d64f23cab108870c736a27682df3fcb48b5f274f1524849a0ae5a75f620bf23c05156626c80f5fdd3eb0ac3204aaf4ace2f2675ba60a

  • SSDEEP

    12288:FK/vg3InPBykantSgDtMWxIqp0vc+lNKp2YAMhNSyz0+szCXnmrKw:FKg3IPSntJb4NaAm9up

Malware Config

Extracted

Family

vidar

C2

http://lade.petperfectcare.com:80

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      7c2764544257198689376324bd69d64f2f296e9aa04d0b81363235aaa27e86d1N

    • Size

      580KB

    • MD5

      43752727d461b7e277347bcc3bb4e330

    • SHA1

      0b5b574edd10e49fb2eeab54a465a1bdc8be358c

    • SHA256

      7c2764544257198689376324bd69d64f2f296e9aa04d0b81363235aaa27e86d1

    • SHA512

      24553f5eccfe865e1ed0d64f23cab108870c736a27682df3fcb48b5f274f1524849a0ae5a75f620bf23c05156626c80f5fdd3eb0ac3204aaf4ace2f2675ba60a

    • SSDEEP

      12288:FK/vg3InPBykantSgDtMWxIqp0vc+lNKp2YAMhNSyz0+szCXnmrKw:FKg3IPSntJb4NaAm9up

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks