Overview

overview

10

Static

static

1

URLScan

urlscan

https://www.youtube....

windows10-ltsc_2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa1Q0XzkyWGctMFR4bk01ZWVfNTJNZ3FRWXJId3xBQ3Jtc0trb2lCQnpCQl96c1ZlWkRnVVRKN3ptTGJ3N3E5djJwaEdVaGJocGtJUmZtNTUtb2lOY1AzelpoM1VFWjNMTmF6WXA2TjdoZXdpRGZUUW1Vbldvd0hpM09yZHItcGExc0pYQUNDYVc4VFQ4SlBkZXRfZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fsbi6e8z4j6wu4%2FWinnisEx&v=YaI8HmUGjRg

  • Sample

    250331-jzytlsvzfv

Score
10/10
vidarc88a663c3425c506a2ca6de08ffb73c8credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

c88a663c3425c506a2ca6de08ffb73c8

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa1Q0XzkyWGctMFR4bk01ZWVfNTJNZ3FRWXJId3xBQ3Jtc0trb2lCQnpCQl96c1ZlWkRnVVRKN3ptTGJ3N3E5djJwaEdVaGJocGtJUmZtNTUtb2lOY1AzelpoM1VFWjNMTmF6WXA2TjdoZXdpRGZUUW1Vbldvd0hpM09yZHItcGExc0pYQUNDYVc4VFQ4SlBkZXRfZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fsbi6e8z4j6wu4%2FWinnisEx&v=YaI8HmUGjRg

    Score
    10/10
    vidarc88a663c3425c506a2ca6de08ffb73c8credential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks