Overview

overview

10

Static

static

3

2025-01-28...ch.exe

windows7-x64

10

2025-01-28...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-28_f3ac472fad06e13f95924e20dae6bf3a_frostygoop_poet-rat_snatch

  • Size

    6.4MB

  • Sample

    250128-g6hd4azrbm

  • MD5

    f3ac472fad06e13f95924e20dae6bf3a

  • SHA1

    63c7f85da8009e917f56ce935d5abd26972764f7

  • SHA256

    e82d4577cac75f1c311b9e86aefb553a518340cc0d52023e21d877909b23513e

  • SHA512

    164fe2ee149cbe7dd62dc6a26a125153991780ad13b1c4c1a0100d54f53253cc19874feddcb5cc952d37f951130464e0a7aafa920fec75f02c215973b0fe3aa1

  • SSDEEP

    49152:/rVH9wJ2mIN21UWc0rL9fo4kr0rJ9CqZ4wCaskewltaEe6UdZ8ZORD17:t9Fm22O0rW7r9wCK

Score
10/10
vidardiscoverystealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Targets

    • Target

      2025-01-28_f3ac472fad06e13f95924e20dae6bf3a_frostygoop_poet-rat_snatch

    • Size

      6.4MB

    • MD5

      f3ac472fad06e13f95924e20dae6bf3a

    • SHA1

      63c7f85da8009e917f56ce935d5abd26972764f7

    • SHA256

      e82d4577cac75f1c311b9e86aefb553a518340cc0d52023e21d877909b23513e

    • SHA512

      164fe2ee149cbe7dd62dc6a26a125153991780ad13b1c4c1a0100d54f53253cc19874feddcb5cc952d37f951130464e0a7aafa920fec75f02c215973b0fe3aa1

    • SSDEEP

      49152:/rVH9wJ2mIN21UWc0rL9fo4kr0rJ9CqZ4wCaskewltaEe6UdZ8ZORD17:t9Fm22O0rW7r9wCK

    Score
    10/10
    vidardiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks