Overview

overview

10

Static

static

1

2025-02-05...ch.exe

windows7-x64

10

2025-02-05...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-05_ec10aad9f32bb3a47d3c87b555eb36a6_frostygoop_hijackloader_poet-rat_snatch

  • Size

    4.5MB

  • Sample

    250205-2fln2swqbk

  • MD5

    ec10aad9f32bb3a47d3c87b555eb36a6

  • SHA1

    d1c644033f6f1970d6d0f69b9ccc47b80a849a16

  • SHA256

    83e56c9a83600499d533e2651fba71444e660fdb32985edebc6b4c19135ab482

  • SHA512

    0023b792b6dd4812177704f3c745c8fe37e6e42919ffda6df55c6fa4173f72de0423d34dd822e73e044e678cb32c5ad4487dd90196f47e8601cc8e30fb1f3de5

  • SSDEEP

    49152:iYAyOIfdsbFR+ywdYFe0vLTj8TLVwl9q3PnPkGVzM2c4SQjFf6x1to3:i7yOMQR+ywWw04T5nmujMo3

Score
10/10
vidardiscoverystealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/sok33tn

https://steamcommunity.com/profiles/76561199824159981
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Targets

    • Target

      2025-02-05_ec10aad9f32bb3a47d3c87b555eb36a6_frostygoop_hijackloader_poet-rat_snatch

    • Size

      4.5MB

    • MD5

      ec10aad9f32bb3a47d3c87b555eb36a6

    • SHA1

      d1c644033f6f1970d6d0f69b9ccc47b80a849a16

    • SHA256

      83e56c9a83600499d533e2651fba71444e660fdb32985edebc6b4c19135ab482

    • SHA512

      0023b792b6dd4812177704f3c745c8fe37e6e42919ffda6df55c6fa4173f72de0423d34dd822e73e044e678cb32c5ad4487dd90196f47e8601cc8e30fb1f3de5

    • SSDEEP

      49152:iYAyOIfdsbFR+ywdYFe0vLTj8TLVwl9q3PnPkGVzM2c4SQjFf6x1to3:i7yOMQR+ywWw04T5nmujMo3

    Score
    10/10
    vidardiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks