Overview

overview

10

Static

static

3

2025-03-31...xz.exe

windows7-x64

1

2025-03-31...xz.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-31_8edfeb2c1a7c0124f467661aa2c21427_black-basta_cobalt-strike_coinminer_satacom_zxxz

  • Size

    47.1MB

  • Sample

    250331-f7d8dswp13

  • MD5

    8edfeb2c1a7c0124f467661aa2c21427

  • SHA1

    5181ad9ea6dc4df7b972044ade6e158f3a969a97

  • SHA256

    cab894aaed4cbd0038876b91c471148a7eef2dea261eae4824fb9899338c766a

  • SHA512

    ec01b8e3c2894b3ed1ff1f636b7672fa7b50c33ff1a41e273093559bb405572dc550f390fbfa9cf96f1d0fde11fa27ff408d8ac795e6c34b55e51b28044edd20

  • SSDEEP

    393216:K76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfdnVQx4urYsANulL7Nw:K0LoCOn+2ds4urYDNulLBiuE

Score
10/10
vidar2cb5abbe09ff77d555a87055cfc206b6credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

13.2

Botnet

2cb5abbe09ff77d555a87055cfc206b6

C2

https://t.me/g_etcontent

https://steamcommunity.com/profiles/76561199832267488
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0

Targets

    • Target

      2025-03-31_8edfeb2c1a7c0124f467661aa2c21427_black-basta_cobalt-strike_coinminer_satacom_zxxz

    • Size

      47.1MB

    • MD5

      8edfeb2c1a7c0124f467661aa2c21427

    • SHA1

      5181ad9ea6dc4df7b972044ade6e158f3a969a97

    • SHA256

      cab894aaed4cbd0038876b91c471148a7eef2dea261eae4824fb9899338c766a

    • SHA512

      ec01b8e3c2894b3ed1ff1f636b7672fa7b50c33ff1a41e273093559bb405572dc550f390fbfa9cf96f1d0fde11fa27ff408d8ac795e6c34b55e51b28044edd20

    • SSDEEP

      393216:K76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfdnVQx4urYsANulL7Nw:K0LoCOn+2ds4urYDNulLBiuE

    Score
    10/10
    vidar2cb5abbe09ff77d555a87055cfc206b6credential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks