vidar

General

Target

G3bSa3Lvws.exe
Size

871KB
Sample

250217-t7x76a1pz3
MD5

1274eda47fd05cc033704d7a27ad5011
SHA1

3c044be6ffec482f9c19da77821783bb79138293
SHA256

80d10d106196d93d19a754478ac3f903f79e1a046e346844eb7f635982b26d96
SHA512

452f7ce1e93c6f040cc280432802c06369302097c514820c8bce652b0e1bef460d49bade9a65cd56e7d894fd4fc5b46aeac836c4a31543c301abd11dcb33981a
SSDEEP

12288:2EL2wlOrnQHCMdVBkPxEs/+xJmeCFupq7goZzQ53nhvrsPRk65XAIWyqz++uxMCC:CjnHxFuM7gouhvIPnXLxPIEwp

Score

10^/10

Malware Config

Targets

- Target
  
  G3bSa3Lvws.exe
- Size
  
  871KB
- MD5
  
  1274eda47fd05cc033704d7a27ad5011
- SHA1
  
  3c044be6ffec482f9c19da77821783bb79138293
- SHA256
  
  80d10d106196d93d19a754478ac3f903f79e1a046e346844eb7f635982b26d96
- SHA512
  
  452f7ce1e93c6f040cc280432802c06369302097c514820c8bce652b0e1bef460d49bade9a65cd56e7d894fd4fc5b46aeac836c4a31543c301abd11dcb33981a
- SSDEEP
  
  12288:2EL2wlOrnQHCMdVBkPxEs/+xJmeCFupq7goZzQ53nhvrsPRk65XAIWyqz++uxMCC:CjnHxFuM7gouhvIPnXLxPIEwp
Score

10^/10

discovery vidar credential_access spyware stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2