vidar | 76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c.exe
Size

272KB
MD5

37797bbf221a8b210a987c3822ee35fc
SHA1

eaa09aee812bd2466c0b750f9edc7e66088c38e2
SHA256

76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c
SHA512

9378befe69eb34494bf2b431147d2cd97bbcd8cc3dd173a097aa0e6facca00314d1f6d843c9a5b09866ec37c13c602833447c4fe52bbbec545d1b9ef544e440b
SSDEEP

3072:ne/3hGz8Su8ucwsy7vf7Qy63S9scCh4slxWsr7i9O3WWsZHpV0iukwEEfzqygF/S:n6xqucZy7vf8f3oMRxb/3W1Hp91Gq

Score

10^/10

vidar discovery stealer

Malware Config

Extracted

Family

vidar

https://t.me/m08mbk

https://steamcommunity.com/profiles/76561199820567237

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c.exe

C:\Users\Admin\AppData\Local\Temp\76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c.exe
"C:\Users\Admin\AppData\Local\Temp\76106d902328efa1e4a8c815e57a130f763a0a1ed5bfd1ba5707874c3ddaa84c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1392-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download