Overview

overview

10

Static

static

3

2025-02-16...ch.exe

windows7-x64

10

2025-02-16...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-16_79f714515891c1f147f5cd2a1f50a709_frostygoop_poet-rat_snatch

  • Size

    6.0MB

  • Sample

    250216-z86tkszkds

  • MD5

    79f714515891c1f147f5cd2a1f50a709

  • SHA1

    08032fe1e4b22bffdab2e26a7d3ecec6ecd2614e

  • SHA256

    4cb7f4f14f3cc8462c1fcd9b297ead2053b227a19559789ad122a0926d308b45

  • SHA512

    3159ab89499e31477fbbce42d1ef5903836337dc2488c4e54cb9fe4349cab943d9683f10ab67c832547e947f84af9b7f9813635e4cbc15c6c88a242bde66f0be

  • SSDEEP

    98304:SDTUWSpQFtPk+Yix8GIzPI1HvFxJoXK0h:0TvFxioPFxJoXK0h

Score
10/10
vidardiscoverystealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/sok33tn

https://steamcommunity.com/profiles/76561199824159981
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Targets

    • Target

      2025-02-16_79f714515891c1f147f5cd2a1f50a709_frostygoop_poet-rat_snatch

    • Size

      6.0MB

    • MD5

      79f714515891c1f147f5cd2a1f50a709

    • SHA1

      08032fe1e4b22bffdab2e26a7d3ecec6ecd2614e

    • SHA256

      4cb7f4f14f3cc8462c1fcd9b297ead2053b227a19559789ad122a0926d308b45

    • SHA512

      3159ab89499e31477fbbce42d1ef5903836337dc2488c4e54cb9fe4349cab943d9683f10ab67c832547e947f84af9b7f9813635e4cbc15c6c88a242bde66f0be

    • SSDEEP

      98304:SDTUWSpQFtPk+Yix8GIzPI1HvFxJoXK0h:0TvFxioPFxJoXK0h

    Score
    10/10
    vidardiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks