Overview

overview

10

Static

static

1

eac4a4c265...bf.exe

windows7-x64

10

eac4a4c265...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eac4a4c26502159bb5547be88595ed2cb526cf8af62b91c59d420698253919bf

  • Size

    598KB

  • Sample

    241011-e585bavhkh

  • MD5

    881a5e66017f5b48400ca06b8541e317

  • SHA1

    ec432c77fdfafb5fd6765af83b3582cb40fa4906

  • SHA256

    eac4a4c26502159bb5547be88595ed2cb526cf8af62b91c59d420698253919bf

  • SHA512

    5c716961acdbc0673b3a8fb2d6b2e3d9cd62be1df52e84514f7e94615893fbee817bdc75a1bef4442d3f1bf0291d88797b5ab116816bcf5e32150eec74f2aa5e

  • SSDEEP

    12288:r8yf0yrFNqYcN6N+dnqISzf1WIPaacNOPy0uXJcajdKbzZqRWlPlj8j264fPsETt:r8EfrFqaIqvf1jIWDuHg7IRdmt

Score
10/10
vidar4a5bc8b73e12425adc3c399da8136891credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Botnet

4a5bc8b73e12425adc3c399da8136891

C2

https://t.me/maslengdsa

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      eac4a4c26502159bb5547be88595ed2cb526cf8af62b91c59d420698253919bf

    • Size

      598KB

    • MD5

      881a5e66017f5b48400ca06b8541e317

    • SHA1

      ec432c77fdfafb5fd6765af83b3582cb40fa4906

    • SHA256

      eac4a4c26502159bb5547be88595ed2cb526cf8af62b91c59d420698253919bf

    • SHA512

      5c716961acdbc0673b3a8fb2d6b2e3d9cd62be1df52e84514f7e94615893fbee817bdc75a1bef4442d3f1bf0291d88797b5ab116816bcf5e32150eec74f2aa5e

    • SSDEEP

      12288:r8yf0yrFNqYcN6N+dnqISzf1WIPaacNOPy0uXJcajdKbzZqRWlPlj8j264fPsETt:r8EfrFqaIqvf1jIWDuHg7IRdmt

    Score
    10/10
    vidar4a5bc8b73e12425adc3c399da8136891credential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks