General

  • Target

    01cddc898479dccce3d215de27163673b5d5d75b2ebbdc0f679e5d044919233f.exe

  • Size

    1023KB

  • Sample

    241014-bc7t1athrb

  • MD5

    21b00885507b17bb51792cbac9cd7d01

  • SHA1

    a8263bb900d757441ee97f73666eb6a381fbead9

  • SHA256

    01cddc898479dccce3d215de27163673b5d5d75b2ebbdc0f679e5d044919233f

  • SHA512

    51cf08f99fc42cb74261f8f9ec7bf4dc8a159b28bd8117baa07cb7a3450b9a0865806f157951471191554ef999ed9f5076e856e0b954976581a617314d0c716c

  • SSDEEP

    24576:YpjxIX0ifL1ql/eTZjJjRyUcx0pJEjO8/Auwdus/xE:YRxIX0ifL1qIjRypCIX/Auwdut

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

191375c1805c0d5109ea6297d63371b2

C2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      01cddc898479dccce3d215de27163673b5d5d75b2ebbdc0f679e5d044919233f.exe

    • Size

      1023KB

    • MD5

      21b00885507b17bb51792cbac9cd7d01

    • SHA1

      a8263bb900d757441ee97f73666eb6a381fbead9

    • SHA256

      01cddc898479dccce3d215de27163673b5d5d75b2ebbdc0f679e5d044919233f

    • SHA512

      51cf08f99fc42cb74261f8f9ec7bf4dc8a159b28bd8117baa07cb7a3450b9a0865806f157951471191554ef999ed9f5076e856e0b954976581a617314d0c716c

    • SSDEEP

      24576:YpjxIX0ifL1ql/eTZjJjRyUcx0pJEjO8/Auwdus/xE:YRxIX0ifL1qIjRypCIX/Auwdut

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.