Overview

overview

10

Static

static

1

code.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    code.ps1

  • Size

    29B

  • Sample

    250212-x7bwpswjhx

  • MD5

    726ac161772f83ef4c852d6c3e158e86

  • SHA1

    66b5487d1d873300d241e96fed4e1ba5d8fea2af

  • SHA256

    630f2e9dc252f71613a30aaf3544739785a64f3f6fc96fbcc960511b29e0eced

  • SHA512

    0b103e71e1a6b5ba400981f45ba460290ec97bd424a80ed4675b12aa68e9d3426bc253c5ae63ad4deba146b69a10b8f532c40344e6194482c3cc73bc4ab95910

Score
10/10
vidarcredential_accessdiscoveryexecutionpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/b4cha00

https://steamcommunity.com/profiles/76561199825403037
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Targets

    • Target

      code.ps1

    • Size

      29B

    • MD5

      726ac161772f83ef4c852d6c3e158e86

    • SHA1

      66b5487d1d873300d241e96fed4e1ba5d8fea2af

    • SHA256

      630f2e9dc252f71613a30aaf3544739785a64f3f6fc96fbcc960511b29e0eced

    • SHA512

      0b103e71e1a6b5ba400981f45ba460290ec97bd424a80ed4675b12aa68e9d3426bc253c5ae63ad4deba146b69a10b8f532c40344e6194482c3cc73bc4ab95910

    Score
    10/10
    vidarcredential_accessdiscoveryexecutionpersistenceprivilege_escalationstealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Modify Authentication Process

1
T1556

Privilege Escalation

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Authentication Process

1
T1556

Modify Registry

2
T1112

Credential Access

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks