Overview

overview

10

Static

static

1

file01.ps1

windows10-2004-x64

10

file01.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file01.ps1

  • Size

    35B

  • Sample

    250120-zpr63symft

  • MD5

    684c57981b5ed26047c34aee9a2453a1

  • SHA1

    2e154e9c0e6abc9a2bc852aeb941fe5d3117fa3e

  • SHA256

    20b3dc9a088153eb974afee08192cd0b78c96b847e5705cea818c50043c3bddf

  • SHA512

    cca14c6add1e0dfed54e0fe425489bf430bcc438acf386fe4d68cf040fbe55e9997b0d85bcd8cca56e66721292497894b599c919f3af248b4a2ef8a1d112c51b

Score
10/10
vidarfc0stndiscoveryexecutionstealer

Malware Config

Extracted

Family

vidar

Botnet

fc0stn

C2

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Targets

    • Target

      file01.ps1

    • Size

      35B

    • MD5

      684c57981b5ed26047c34aee9a2453a1

    • SHA1

      2e154e9c0e6abc9a2bc852aeb941fe5d3117fa3e

    • SHA256

      20b3dc9a088153eb974afee08192cd0b78c96b847e5705cea818c50043c3bddf

    • SHA512

      cca14c6add1e0dfed54e0fe425489bf430bcc438acf386fe4d68cf040fbe55e9997b0d85bcd8cca56e66721292497894b599c919f3af248b4a2ef8a1d112c51b

    Score
    10/10
    vidarfc0stndiscoveryexecutionstealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks