Overview

overview

10

Static

static

3

config.exe

windows7-x64

10

config.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    config.exe

  • Size

    5.2MB

  • Sample

    250223-a94yyatmdn

  • MD5

    fcdd5d8bbdd7e9c70b30904c37267bb2

  • SHA1

    6c8c923851462e0c97b48b3826643eea441ed8b6

  • SHA256

    d9b7cd71505bd423ba63c900c792c585314c44d9515cd2767f6c9826e8237979

  • SHA512

    2ea5167cb7c6f4d87d2e3a595cdd40a2be9e24098841a40c64bf50db9e55f954ae7da0646d9ae10f4e833ba793a94fb304791445c8f9f78197e11ce04af012eb

  • SSDEEP

    49152:8l2I+TsDdNum6TfbV+/74e1HOiiI1qCRzecn5EZ8AoFVWkjDH4P1EKLR1Ic201o7:8YI+T8XqfbVy4IuilzfzHhc2PF

Score
10/10
vidarcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/g02f04

https://steamcommunity.com/profiles/76561199828130190
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Targets

    • Target

      config.exe

    • Size

      5.2MB

    • MD5

      fcdd5d8bbdd7e9c70b30904c37267bb2

    • SHA1

      6c8c923851462e0c97b48b3826643eea441ed8b6

    • SHA256

      d9b7cd71505bd423ba63c900c792c585314c44d9515cd2767f6c9826e8237979

    • SHA512

      2ea5167cb7c6f4d87d2e3a595cdd40a2be9e24098841a40c64bf50db9e55f954ae7da0646d9ae10f4e833ba793a94fb304791445c8f9f78197e11ce04af012eb

    • SSDEEP

      49152:8l2I+TsDdNum6TfbV+/74e1HOiiI1qCRzecn5EZ8AoFVWkjDH4P1EKLR1Ic201o7:8YI+T8XqfbVy4IuilzfzHhc2PF

    Score
    10/10
    vidarcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks