Overview

overview

10

Static

static

1

URLScan

urlscan

http://test

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://test

  • Sample

    241226-n3acmsvnfl

Score
10/10
vidardiscoveryexecutionstealer

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://recaptcha-dns-b4.pages.dev

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/BrianSL16/effective-meme/refs/heads/main/mutation.txt

Targets

    • Target

      http://test

    Score
    10/10
    vidardiscoveryexecutionstealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks