General
-
Target
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8.exe
-
Size
580KB
-
Sample
241010-nel2jazfkl
-
MD5
065ec3e648ea7844d25cac613171abe9
-
SHA1
b0d86176756c0aae3ef5517939cf3dc46acc690a
-
SHA256
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8
-
SHA512
2a4422ad784e04f7166767b0c5af030c7f0dfe151b37e7d4164d09116aa38db4dabb67d8ed4797ebab1a9eb5c1012d1bd3bcd8b1a788bf6b95751ecbd7d1c670
-
SSDEEP
12288:WKLvg3InPB1f0tEB68UZGgxzgmAlgLJQfgQO3O9u32wiSak/+yrK8:WKc3IPbmeP3gla8QW3d32wLaktd
Static task
static1
Behavioral task
behavioral1
Sample
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vidar
http://proxy.johnmccrea.com/
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Targets
-
-
Target
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8.exe
-
Size
580KB
-
MD5
065ec3e648ea7844d25cac613171abe9
-
SHA1
b0d86176756c0aae3ef5517939cf3dc46acc690a
-
SHA256
01a67ace9d97e4ae157c3a68f9ba7fb919949b5569cec1880b29ffd349bdcca8
-
SHA512
2a4422ad784e04f7166767b0c5af030c7f0dfe151b37e7d4164d09116aa38db4dabb67d8ed4797ebab1a9eb5c1012d1bd3bcd8b1a788bf6b95751ecbd7d1c670
-
SSDEEP
12288:WKLvg3InPB1f0tEB68UZGgxzgmAlgLJQfgQO3O9u32wiSak/+yrK8:WKc3IPbmeP3gla8QW3d32wLaktd
Score10/10-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-