Overview

overview

10

Static

static

1

fb70d59686...9e.ps1

windows7-x64

3

fb70d59686...9e.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb70d59686e9c99b78c715127367fa46eea1359baf7ff6e0644ff19d0674359e.unknown

  • Size

    131KB

  • Sample

    250220-fap9dswqhv

  • MD5

    54fbe16bb5ff1ed4ef9ecdbfb97905ca

  • SHA1

    f71d316766bd20b975c0b67d423e05d53fc59b93

  • SHA256

    fb70d59686e9c99b78c715127367fa46eea1359baf7ff6e0644ff19d0674359e

  • SHA512

    585a182fba0de848fa58d2243ddb6a27e9cea319728f1386b65f0f6baf398b88b1ec0274018604955db3b592ffbed3a61603b48f4c03ff975428476883cd57ca

  • SSDEEP

    3072:U1I6D5sqVQ0p0qZAmJHeo6oTBUPn3m7oUQRDKzn6uIr352hiNY:X65zbp/imJ+o6oTBim7oUQR+6hp2v

Score
10/10
vidarcredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      fb70d59686e9c99b78c715127367fa46eea1359baf7ff6e0644ff19d0674359e.unknown

    • Size

      131KB

    • MD5

      54fbe16bb5ff1ed4ef9ecdbfb97905ca

    • SHA1

      f71d316766bd20b975c0b67d423e05d53fc59b93

    • SHA256

      fb70d59686e9c99b78c715127367fa46eea1359baf7ff6e0644ff19d0674359e

    • SHA512

      585a182fba0de848fa58d2243ddb6a27e9cea319728f1386b65f0f6baf398b88b1ec0274018604955db3b592ffbed3a61603b48f4c03ff975428476883cd57ca

    • SSDEEP

      3072:U1I6D5sqVQ0p0qZAmJHeo6oTBUPn3m7oUQRDKzn6uIr352hiNY:X65zbp/imJ+o6oTBim7oUQR+6hp2v

    Score
    10/10
    executionvidarcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks