Overview

overview

10

Static

static

3

2025-01-23...ch.exe

windows7-x64

10

2025-01-23...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-23_0efa5966ba018424377f72a92301264e_frostygoop_poet-rat_snatch

  • Size

    11.8MB

  • Sample

    250123-f3lrnswjaj

  • MD5

    0efa5966ba018424377f72a92301264e

  • SHA1

    8d70aab10c528b33fb7d5f720ff3a53f5013ef50

  • SHA256

    9c6b7c989fa5211fe8a3143cb5239dfd40f24ed749100e6d04ea96b99761237f

  • SHA512

    ac1c3c0dd26a7d843df52f2d908302eb8eb9cfbe6fb57efc7a4d8835cf090c2db7c3994086653ae0241bc9b6c3e874d8f9b18a26b7dcf8adb954c1d38e79c88e

  • SSDEEP

    98304:3HdrKq4K/+EsUW7Klb4ci34izanPfbnBS25VOv+5jEa/l2mMmfMOyZLj:3duv835i34izanl0v+xE2lWmfMOy9

Score
10/10
vidarfc0stndiscoverystealer

Malware Config

Extracted

Family

vidar

Botnet

fc0stn

C2

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Targets

    • Target

      2025-01-23_0efa5966ba018424377f72a92301264e_frostygoop_poet-rat_snatch

    • Size

      11.8MB

    • MD5

      0efa5966ba018424377f72a92301264e

    • SHA1

      8d70aab10c528b33fb7d5f720ff3a53f5013ef50

    • SHA256

      9c6b7c989fa5211fe8a3143cb5239dfd40f24ed749100e6d04ea96b99761237f

    • SHA512

      ac1c3c0dd26a7d843df52f2d908302eb8eb9cfbe6fb57efc7a4d8835cf090c2db7c3994086653ae0241bc9b6c3e874d8f9b18a26b7dcf8adb954c1d38e79c88e

    • SSDEEP

      98304:3HdrKq4K/+EsUW7Klb4ci34izanPfbnBS25VOv+5jEa/l2mMmfMOyZLj:3duv835i34izanl0v+xE2lWmfMOy9

    Score
    10/10
    vidarfc0stndiscoverystealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks