vidar | 5ce7687d00cc5cdc0b7575bc68940f7a092a1f559f987f3b6a9b0c837eaa6496 | Triage

Submit
Reports

Overview

overview

Static

static

3

crypted.exe

windows7-x64

1

crypted.exe

windows10-2004-x64

Sharing

General

Target

crypted.exe
Size

1.7MB
Sample

250330-ng65gsxwgv
MD5

175c9b6b2db3b3624f7df4c54dff3262
SHA1

a96c038467d2d6ff0b95275a828948997b6987a3
SHA256

5ce7687d00cc5cdc0b7575bc68940f7a092a1f559f987f3b6a9b0c837eaa6496
SHA512

3d728ce053930f16c8debc087807b3eaadef3c9b21a452b49f13ce767b35b221e71b15db8c849fe71c7d0077d2c0ab31506762626622f87347c596260cddff34
SSDEEP

24576:2iB4QbCAnGZPk/jhW2DQQ3iF2K8+2ntZ8oWyOpZwrlUR:2iB490ykrlUR

Score

10^/10

vidar 00cb84c6bd4caac4bdfc1131beae4df7 credential_access discovery spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

crypted.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

crypted.exe

Resource

win10v2004-20250313-en

vidar 00cb84c6bd4caac4bdfc1131beae4df7 credential_access discovery spyware stealer

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

00cb84c6bd4caac4bdfc1131beae4df7

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Targets

- Target
  
  crypted.exe
- Size
  
  1.7MB
- MD5
  
  175c9b6b2db3b3624f7df4c54dff3262
- SHA1
  
  a96c038467d2d6ff0b95275a828948997b6987a3
- SHA256
  
  5ce7687d00cc5cdc0b7575bc68940f7a092a1f559f987f3b6a9b0c837eaa6496
- SHA512
  
  3d728ce053930f16c8debc087807b3eaadef3c9b21a452b49f13ce767b35b221e71b15db8c849fe71c7d0077d2c0ab31506762626622f87347c596260cddff34
- SSDEEP
  
  24576:2iB4QbCAnGZPk/jhW2DQQ3iF2K8+2ntZ8oWyOpZwrlUR:2iB490ykrlUR
Score

10^/10

vidar 00cb84c6bd4caac4bdfc1131beae4df7 credential_access discovery spyware stealer
- Detect Vidar Stealer
  stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Credential Access

Modify Authentication Process

Steal Web Session Cookie

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

vidar00cb84c6bd4caac4bdfc1131beae4df7credential_accessdiscoveryspywarestealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.