vidar | b2a0dbf1e8cca9b812c181701c9400c9f3c103cc9a8a0d19db8806eaeae75577

General

Target

135c2ccc41108ae0a65c7fc38b74698f.exe
Size

320KB
MD5

135c2ccc41108ae0a65c7fc38b74698f
SHA1

f5b37b15de5683a413a441de19d3694353f8d31f
SHA256

b2a0dbf1e8cca9b812c181701c9400c9f3c103cc9a8a0d19db8806eaeae75577
SHA512

7d51b58f955a86824fba50b0839cf819154ba348a29a6653f8f5f239175e76df6cbd3a0a6062b04872b98ef775c334eb5f6cae10c2fbacb6dd4febc12568b897
SSDEEP

6144:QBYNPLTpaMCcqwas+9Jl9iH7soLSEV9GLA:QSNP/pXCfwas0tiH7soLSU9kA

Score

10^/10

vidar c64547eb2b04e7463b7c963bad74ee2f discovery stealer

Malware Config

Extracted

Family

vidar

Version

12.6

Botnet

c64547eb2b04e7463b7c963bad74ee2f

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Detect Vidar Stealer 27 IoCs

stealer

resource	yara_rule
behavioral2/memory/4012-1-0x0000000000530000-0x000000000054F000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-2-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-5-0x0000000000530000-0x000000000054F000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-6-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-7-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-11-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-15-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-21-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-25-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-29-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-35-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-39-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-43-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-49-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-53-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-57-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-63-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-67-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-71-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-77-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-81-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-85-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-91-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-95-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-99-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-105-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7
behavioral2/memory/4012-109-0x0000000000400000-0x0000000000454000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	135c2ccc41108ae0a65c7fc38b74698f.exe

C:\Users\Admin\AppData\Local\Temp\135c2ccc41108ae0a65c7fc38b74698f.exe
"C:\Users\Admin\AppData\Local\Temp\135c2ccc41108ae0a65c7fc38b74698f.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OMQG84ST\76561199819539662[1].htm

Filesize
34KB

MD5
843bed19730bb3ca4fb707102bb90530

SHA1
3371bee21c3133b6906992f663087c481f50c34d

SHA256
5ea0b6e48d3f2922dc363fcb83e678f5917c87e030fba8750474d1ce6301ce22

SHA512
d509d555884ffa7a88c4beadf94cfe8a24decd45b18bbcde9a4dad86522f7d70fdffc8a5cd948b3a8177430f228d7d93c774f29502abfb914b8922f734d6c927

Download Submit
memory/4012-39-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-67-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-4-0x00000000021C0000-0x00000000021EB000-memory.dmp

Filesize
172KB

Download
memory/4012-5-0x0000000000530000-0x000000000054F000-memory.dmp

Filesize
124KB

Download
memory/4012-6-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4012-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-0-0x00000000021C0000-0x00000000021EB000-memory.dmp

Filesize
172KB

Download
memory/4012-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-21-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-25-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-29-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-35-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-1-0x0000000000530000-0x000000000054F000-memory.dmp

Filesize
124KB

Download
memory/4012-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4012-53-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-43-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-57-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-63-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-49-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-71-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-77-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-81-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-85-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-91-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-95-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-99-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-105-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4012-109-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing