Overview

overview

10

Static

static

3

2024-10-30...ch.exe

windows7-x64

10

2024-10-30...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.zip

  • Size

    3.1MB

  • Sample

    241030-zn1f3azkfx

  • MD5

    f0cb017145c8368959baff5d6689ffd4

  • SHA1

    b26ea74aa7fb4f23e88fbbd721826f5fb5d87381

  • SHA256

    621b6076d404223bcecfd866f8fc2cee4c116320045eb916f7e6ace3feaea3fc

  • SHA512

    afa0683bd3a2e1eb733bca26a9c592cf76631ba2a8277a0eb8075ad44921379491cb21a910991aea012722a1d72f1948da061bdf9b08871f6aa3945793e61e31

  • SSDEEP

    98304:36D4cF0rhb0R8mqO+oL37wM1NPoskTbTiT4:qDdohWKo/w7hXiT4

Score
10/10
vidarcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Targets

    • Target

      2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch

    • Size

      6.2MB

    • MD5

      6dc517f58f112adcdd3cfae606a67964

    • SHA1

      b59f74642e963111027613ce0206ca77aec06fda

    • SHA256

      2a559ce1ff609781226319d7f57d6c8cf32487bd87bb796ea43ee015aa104a73

    • SHA512

      6f04ac98d9ea1eb203d2b93e9ff9f02a26b2ff61a4afc61b47f5d7f6260a80bc085fbc24c97c43407651c231156f468d4fe00cb152e64c6be948fed6b19f4ed8

    • SSDEEP

      98304:cTiMEvjmzKewwsZ2XoCx7fR+Q6VCKrUk:iiMEaI24C1UQszrU

    Score
    10/10
    vidarcredential_accessdiscoverystealerspyware

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks