Overview

overview

10

Static

static

3

2025-01-21...ch.exe

windows7-x64

10

2025-01-21...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-21_32cbf22c838150348ce7a2410c5f8805_frostygoop_poet-rat_snatch

  • Size

    7.2MB

  • Sample

    250121-tvk23asldv

  • MD5

    32cbf22c838150348ce7a2410c5f8805

  • SHA1

    9d8da1530cb714cfbc39e320f38f87c8af817d6b

  • SHA256

    3da82f3fd8dba6b11ab41996edaa1b3e10dddf67f2f948cdaed290d5fae2c67d

  • SHA512

    73cad6066c443141101d5b855283e3a3c20935d8bcc0869462b3291b249d8ffd591da0967a3566d7ecf8377e7ad3989c0530b1dfca20df5696aa0f8a064d4b1f

  • SSDEEP

    49152:xCOiPIhToY3gVIsuL5yE9nijTYAzQVpmfOYEtNk6fmcMlOH4U5X0+S2umabNn1h:xCLIRLsulBaTYY8Iw0J

Score
10/10
vidarfc0stndiscoverystealer

Malware Config

Extracted

Family

vidar

Botnet

fc0stn

C2

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Targets

    • Target

      2025-01-21_32cbf22c838150348ce7a2410c5f8805_frostygoop_poet-rat_snatch

    • Size

      7.2MB

    • MD5

      32cbf22c838150348ce7a2410c5f8805

    • SHA1

      9d8da1530cb714cfbc39e320f38f87c8af817d6b

    • SHA256

      3da82f3fd8dba6b11ab41996edaa1b3e10dddf67f2f948cdaed290d5fae2c67d

    • SHA512

      73cad6066c443141101d5b855283e3a3c20935d8bcc0869462b3291b249d8ffd591da0967a3566d7ecf8377e7ad3989c0530b1dfca20df5696aa0f8a064d4b1f

    • SSDEEP

      49152:xCOiPIhToY3gVIsuL5yE9nijTYAzQVpmfOYEtNk6fmcMlOH4U5X0+S2umabNn1h:xCLIRLsulBaTYY8Iw0J

    Score
    10/10
    vidarfc0stndiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks