vidar | 2024-10-19_6253ec49804d1a4c348e1e096fa2ee74_cobalt-strike_mafia

General

Target
2024-10-19_6253ec49804d1a4c348e1e096fa2ee74_cobalt-strike_mafia
Size 574KB
Sample241019-sf9ansscle
SHA256 9464b8d7a79d4f618ac5001c3726ff02d5fbc6c00aa6c23bf1d01a083dd5f935
MD5 6253ec49804d1a4c348e1e096fa2ee74
SHA1 c4bf885cd3a99e68360d43cf065cb5962e1e306f
SHA512 48f573b822ee4c39668f4da5b075522fff0ba2487d1c409bcece6d94c4b0d18f638ab212cbc7bd55a00b60d0b6d4e06eaf5041353886842c57e9b3177b997a2e
SSDEEP 12288:SewUbV211CKvE2i3KghRiAqqUEGq60dKjZL0VYExdZaZ04S:S2V2FE2i3KghRiAqqUEGq6AKjZ5OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer 4a5bc8b73e12425adc3c399da8136891 vidar

Malware Config

Extracted

Family

vidar

Botnet

4a5bc8b73e12425adc3c399da8136891

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-19_6253ec49804d1a4c348e1e096fa2ee74_cobalt-strike_mafia

File Explorer

2024-10-19_6253ec49804d1a4c348e1e096fa2ee74_cobalt-strike_mafia

.exe 574KB

2024-10-19_6253ec49804d1a4c348e1e096fa2ee74_cobalt-strike_mafia

IMPHASH d10af643340e1121562abe3e6bd5b0e1
SHA256 9464b8d7a79d4f618ac5001c3726ff02d5fbc6c00aa6c23bf1d01a083dd5f935
MD5 6253ec49804d1a4c348e1e096fa2ee74
SHA1 c4bf885cd3a99e68360d43cf065cb5962e1e306f
SHA512 48f573b822ee4c39668f4da5b075522fff0ba2487d1c409bcece6d94c4b0d18f638ab212cbc7bd55a00b60d0b6d4e06eaf5041353886842c57e9b3177b997a2e
SSDEEP 12288:SewUbV211CKvE2i3KghRiAqqUEGq60dKjZL0VYExdZaZ04S:S2V2FE2i3KghRiAqqUEGq6AKjZ5OK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detect Vidar Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AttachConsole MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap ReadConsoleW HeapSize WriteConsoleW

Sharing