General

  • Target

    8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b

  • Size

    8.3MB

  • Sample

    241120-bjcx7sxfnr

  • MD5

    2780aa0eed2951601dc61d4c38011b85

  • SHA1

    1e5b178f61f58a9e90b267d881c20031f530c001

  • SHA256

    8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b

  • SHA512

    f599fec839cb48c3c145e0ef8583949fff3b5538b8ad402bd4e06b6f851c7bb682f884757fa6dbaac3fce134c34cd86236abc76b7c657d4370cdcf4046c2f09e

  • SSDEEP

    196608:exOxtJahKu0vlXzxh+ZD2G1md3dtonTkM:7xtJtzX2ZD2GUtonv

Malware Config

Extracted

Family

vidar

Version

11.7

Botnet

8ec2721615c8de7e0afa1fdbfc111f76

C2

https://t.me/m07mbk

https://steamcommunity.com/profiles/76561199801589826

Targets

    • Target

      8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b

    • Size

      8.3MB

    • MD5

      2780aa0eed2951601dc61d4c38011b85

    • SHA1

      1e5b178f61f58a9e90b267d881c20031f530c001

    • SHA256

      8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b

    • SHA512

      f599fec839cb48c3c145e0ef8583949fff3b5538b8ad402bd4e06b6f851c7bb682f884757fa6dbaac3fce134c34cd86236abc76b7c657d4370cdcf4046c2f09e

    • SSDEEP

      196608:exOxtJahKu0vlXzxh+ZD2G1md3dtonTkM:7xtJtzX2ZD2GUtonv

    • Detect Vidar Stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks