General

  • Target

    ktyihkdfesf.exe

  • Size

    144KB

  • Sample

    241220-hdz9wasrel

  • MD5

    cc36e2a5a3c64941a79c31ca320e9797

  • SHA1

    50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

  • SHA256

    6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

  • SHA512

    fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

  • SSDEEP

    3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdEpx:A/rLVPW0nsP2Xy+TJfWzW7

Malware Config

Targets

    • Target

      ktyihkdfesf.exe

    • Size

      144KB

    • MD5

      cc36e2a5a3c64941a79c31ca320e9797

    • SHA1

      50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

    • SHA256

      6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

    • SHA512

      fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

    • SSDEEP

      3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdEpx:A/rLVPW0nsP2Xy+TJfWzW7

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.