vidar | 168ae0f09a9376003d735b592b46125da5cc43d7e13ce7d9007328f76fb4ae8a | Triage

Submit
Reports

Overview

overview

Static

static

3

2024-12-25...ch.exe

windows7-x64

1

2024-12-25...ch.exe

windows10-2004-x64

Sharing

General

Target

2024-12-25_6d6bbf1e873fb791141ea7fe2c166dcf_frostygoop_poet-rat_snatch
Size

21.1MB
Sample

241225-ghgsnayrfv
MD5

6d6bbf1e873fb791141ea7fe2c166dcf
SHA1

bb43a4a6bcf531617ba95c4a9a18807322196f6f
SHA256

168ae0f09a9376003d735b592b46125da5cc43d7e13ce7d9007328f76fb4ae8a
SHA512

b10059c3696fa4cc216cb54dcb2893453bc85f496372aa0f369a081abe6632dfc2a1e8fb8bf37db867fb8f71e0467b6e467b8a9a79a253ddb550491e22d7a2fc
SSDEEP

49152:OZN6W2fQrQOVlMmtSUmUCAI/sysIDuEjj6fk2UucKP9dQb:c6WDRKLUCZ2UucKFm

Score

10^/10

vidar credential_access discovery stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2024-12-25_6d6bbf1e873fb791141ea7fe2c166dcf_frostygoop_poet-rat_snatch.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

2024-12-25_6d6bbf1e873fb791141ea7fe2c166dcf_frostygoop_poet-rat_snatch.exe

Resource

win10v2004-20241007-en

vidar credential_access discovery stealer

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024-12-25_6d6bbf1e873fb791141ea7fe2c166dcf_frostygoop_poet-rat_snatch
- Size
  
  21.1MB
- MD5
  
  6d6bbf1e873fb791141ea7fe2c166dcf
- SHA1
  
  bb43a4a6bcf531617ba95c4a9a18807322196f6f
- SHA256
  
  168ae0f09a9376003d735b592b46125da5cc43d7e13ce7d9007328f76fb4ae8a
- SHA512
  
  b10059c3696fa4cc216cb54dcb2893453bc85f496372aa0f369a081abe6632dfc2a1e8fb8bf37db867fb8f71e0467b6e467b8a9a79a253ddb550491e22d7a2fc
- SSDEEP
  
  49152:OZN6W2fQrQOVlMmtSUmUCAI/sysIDuEjj6fk2UucKP9dQb:c6WDRKLUCZ2UucKFm
Score

10^/10

vidar credential_access discovery stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

vidarcredential_accessdiscoverystealer

© 2018-2025

Terms | Privacy