General
-
Target
https://goo.su/G3LwWcK
-
Sample
241113-xvv4taxfng
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://goo.su/G3LwWcK
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://goo.su/G3LwWcK
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
9 signatures
1800 seconds
Malware Config
Extracted
Family
vidar
Version
5
Botnet
8c52f3ec6eb37ecedc912a0179f9e97f
C2
https://t.me/hypergog
https://steamcommunity.com/profiles/76561199642171824
Attributes
-
profile_id_v2
8c52f3ec6eb37ecedc912a0179f9e97f
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Targets
-
-
Target
https://goo.su/G3LwWcK
-
Detect Vidar Stealer
-
Vidar family
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-