Overview

overview

10

Static

static

1

nouveau.bat

windows7-x64

3

nouveau.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nouveau.bat

  • Size

    97B

  • Sample

    250212-vzgqwa1kdr

  • MD5

    6c6d012324d2e576b72ff7ed88f34c2e

  • SHA1

    c956c1642bda663f0f41ce31571731c0e5af1d91

  • SHA256

    ad94cad57a4d8181d40502c1cde3b95774308f9295dda3546bdb357e732949d3

  • SHA512

    cbd33eb2052b5e94305a78c99bc53dcf3c8681d283e41860f6d3b41a818bf0b5e15f40f4fa86d0544ab77d44844bde1c9c32f341b520572e000d3b88048599ac

Score
10/10
vidarcredential_accessdiscoveryexecutionstealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/b4cha00

https://steamcommunity.com/profiles/76561199825403037
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Targets

    • Target

      nouveau.bat

    • Size

      97B

    • MD5

      6c6d012324d2e576b72ff7ed88f34c2e

    • SHA1

      c956c1642bda663f0f41ce31571731c0e5af1d91

    • SHA256

      ad94cad57a4d8181d40502c1cde3b95774308f9295dda3546bdb357e732949d3

    • SHA512

      cbd33eb2052b5e94305a78c99bc53dcf3c8681d283e41860f6d3b41a818bf0b5e15f40f4fa86d0544ab77d44844bde1c9c32f341b520572e000d3b88048599ac

    Score
    10/10
    executionvidarcredential_accessdiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks