General

  • Target

    LauncherSetupV.zip

  • Size

    56.6MB

  • Sample

    241115-k77l6awjbk

  • MD5

    a6f5e4ce42eb0624946813e680aa057c

  • SHA1

    3c0f9c1c003a69e7a5c4a4f0293b3ce461eea589

  • SHA256

    dc920ddca708c2f3764f9c62450e04887f9b92b91aba01d642632f5896304629

  • SHA512

    724013ce3c17983754c8a2b6ae2351d231a5df61c74b16036b817891d990f92320fdc3c8f1a6fc3ae61c32727ec8c6da53c45662faa2f3f8d192c816bac34837

  • SSDEEP

    1572864:kDZSBtFQmiwzUTMLFp/iI8KD+G9xyNG1VaLZj:oZSP+9wCMOIJD+Dvp

Malware Config

Extracted

Family

vidar

Version

11.7

Botnet

93fc6460673f6002db33ceb23a9e1868

C2

https://t.me/m07mbk

https://steamcommunity.com/profiles/76561199801589826

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Targets

    • Target

      LauncherSetupV.zip

    • Size

      56.6MB

    • MD5

      a6f5e4ce42eb0624946813e680aa057c

    • SHA1

      3c0f9c1c003a69e7a5c4a4f0293b3ce461eea589

    • SHA256

      dc920ddca708c2f3764f9c62450e04887f9b92b91aba01d642632f5896304629

    • SHA512

      724013ce3c17983754c8a2b6ae2351d231a5df61c74b16036b817891d990f92320fdc3c8f1a6fc3ae61c32727ec8c6da53c45662faa2f3f8d192c816bac34837

    • SSDEEP

      1572864:kDZSBtFQmiwzUTMLFp/iI8KD+G9xyNG1VaLZj:oZSP+9wCMOIJD+Dvp

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks