Overview

overview

10

Static

static

3

2025-01-21...ch.exe

windows7-x64

10

2025-01-21...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-21_aab8d2e4a6bb1dea638155d09a165a79_frostygoop_poet-rat_snatch

  • Size

    6.2MB

  • Sample

    250121-w1vjsswnax

  • MD5

    aab8d2e4a6bb1dea638155d09a165a79

  • SHA1

    75aa5e844d8bcca5ec838d93a3157c886a8cc0c8

  • SHA256

    a97f2c096c3e9cb0d693d226726c0b100d5ebf99e832db3e40c4f48db6016390

  • SHA512

    d5d436f624b9fa3878ae3d0cb5b4e6c60bb85e9877c84049947522a5ab1210d20ccd2a8f626f188d7a98450a8ed2b74be99d9b977233cde257e5aec470913586

  • SSDEEP

    49152:xCOiPIhToY3gVIsuL5yE9nijTYAzQVpmfOYEtNk6fmcMlOH4U5X0+S2umabNn1h:xCLIRLsulBaTYY8Iw0J

Score
10/10
vidarfc0stndiscoverystealer

Malware Config

Extracted

Family

vidar

Botnet

fc0stn

C2

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Targets

    • Target

      2025-01-21_aab8d2e4a6bb1dea638155d09a165a79_frostygoop_poet-rat_snatch

    • Size

      6.2MB

    • MD5

      aab8d2e4a6bb1dea638155d09a165a79

    • SHA1

      75aa5e844d8bcca5ec838d93a3157c886a8cc0c8

    • SHA256

      a97f2c096c3e9cb0d693d226726c0b100d5ebf99e832db3e40c4f48db6016390

    • SHA512

      d5d436f624b9fa3878ae3d0cb5b4e6c60bb85e9877c84049947522a5ab1210d20ccd2a8f626f188d7a98450a8ed2b74be99d9b977233cde257e5aec470913586

    • SSDEEP

      49152:xCOiPIhToY3gVIsuL5yE9nijTYAzQVpmfOYEtNk6fmcMlOH4U5X0+S2umabNn1h:xCLIRLsulBaTYY8Iw0J

    Score
    10/10
    vidarfc0stndiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks