Overview

overview

10

Static

static

1

74b05fbc38...8N.exe

windows7-x64

10

74b05fbc38...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74b05fbc385685bb0f7e5d8420042aa661151be9e93c08383ef933f522ee8e58N

  • Size

    598KB

  • Sample

    241011-wzweps1emq

  • MD5

    b48be27582c0ac8db3785a2e389498d0

  • SHA1

    1494c48a07ab799b0cf2ed9c5105771be1d1581a

  • SHA256

    74b05fbc385685bb0f7e5d8420042aa661151be9e93c08383ef933f522ee8e58

  • SHA512

    be7839ec69a2ebb5efb91123945ca8258a795271b98b09573e1e933352ffa86fb722909a0c920ac75b64755601075193772115bdff0088930b617b2c3459dda5

  • SSDEEP

    12288:E8yf0yrFNqimGLIJT2E3WY5q2EQ8ZB90h3w4Ll64fPsETEO:E8EfrFmTJT2wx5q2EIhg4odmt

Score
10/10
vidar5d5c21db908d8fe19952873f9f748174credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Botnet

5d5c21db908d8fe19952873f9f748174

C2

https://t.me/maslengdsa

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      74b05fbc385685bb0f7e5d8420042aa661151be9e93c08383ef933f522ee8e58N

    • Size

      598KB

    • MD5

      b48be27582c0ac8db3785a2e389498d0

    • SHA1

      1494c48a07ab799b0cf2ed9c5105771be1d1581a

    • SHA256

      74b05fbc385685bb0f7e5d8420042aa661151be9e93c08383ef933f522ee8e58

    • SHA512

      be7839ec69a2ebb5efb91123945ca8258a795271b98b09573e1e933352ffa86fb722909a0c920ac75b64755601075193772115bdff0088930b617b2c3459dda5

    • SSDEEP

      12288:E8yf0yrFNqimGLIJT2E3WY5q2EQ8ZB90h3w4Ll64fPsETEO:E8EfrFmTJT2wx5q2EIhg4odmt

    Score
    10/10
    vidar5d5c21db908d8fe19952873f9f748174credential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks