Overview

overview

10

Static

static

1

UniversitiesGe.exe

windows7-x64

10

UniversitiesGe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UniversitiesGe.exe

  • Size

    828KB

  • Sample

    250208-vhyytsxnbq

  • MD5

    d05c6019e8f4f2d004ae9055e1c8079d

  • SHA1

    13b411440b37d1134c09018fcc55b215d3743314

  • SHA256

    e5dd75c651de425c6ff14196ae0b026bd38a09bc9b535315a8d03e4c3c1c0a40

  • SHA512

    c33f0595b910e9664768003b76ea897a95ead7b063d5e58035587801798dfb4caa55351a0dca811c88450c6899602fcb1bd44fcb033f11d39652e65ea42e1d92

  • SSDEEP

    24576:KG0h0scaIrCcBGUGMx2R9THpPlP0tIkYqio:MhJcZhBpGMx+lPlsJdd

Score
10/10
vidardiscoverystealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Targets

    • Target

      UniversitiesGe.exe

    • Size

      828KB

    • MD5

      d05c6019e8f4f2d004ae9055e1c8079d

    • SHA1

      13b411440b37d1134c09018fcc55b215d3743314

    • SHA256

      e5dd75c651de425c6ff14196ae0b026bd38a09bc9b535315a8d03e4c3c1c0a40

    • SHA512

      c33f0595b910e9664768003b76ea897a95ead7b063d5e58035587801798dfb4caa55351a0dca811c88450c6899602fcb1bd44fcb033f11d39652e65ea42e1d92

    • SSDEEP

      24576:KG0h0scaIrCcBGUGMx2R9THpPlP0tIkYqio:MhJcZhBpGMx+lPlsJdd

    Score
    10/10
    vidardiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks