Overview

overview

10

Static

static

10

rihuata-ma...sa.exe

windows10-ltsc_2021-x64

10

rihuata-ma...er.exe

windows10-ltsc_2021-x64

10

rihuata-ma...ep.exe

windows10-ltsc_2021-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rihuata-main.zip

  • Size

    42.4MB

  • MD5

    19ab179a340d2ca155efb4fc6efd95f1

  • SHA1

    d5acebe5e5047b4514d24b2bd586b88453a1400e

  • SHA256

    214082ec55ebca25be21e5b5227ad0e89c08026c55a21fc57dc4bd2764f5d28f

  • SHA512

    e7e4ef683845d643f9aaa8b3e4b2ff88af2e7a4e1ced606dfa0de998e4d81e5adcb62aaae3618f168ca758c87657963692454939b4a4ccac96a8ad2a51aac4d5

  • SSDEEP

    786432:dlhsUS0/sxHUwpoh46w84ubV4BjVzHnOg7G6TWSuzUMKnN:Lhsu/sNUSoh46N4uB4BJz1GAduy

Score
10/10
stealer23b8a0e48f77dc82cb41b2936121fd07b67a308257f21ac98cb4828b3f69a282886e3178ef0cef21a6ff7125395660f2f8127ecb24efc59dc898cb2fe66fd001ratvidargurcupovertystealerbitratdcrat

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

23b8a0e48f77dc82cb41b2936121fd07

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8044316559:AAFBKJlXZImRdKtbDCT2g5_pK-tOr4SgrOo/sendMessage?chat_id=7099179555

http://96.9.124.250:8070

http://209.38.221.184:8080

http://46.235.26.83:8080

http://147.28.185.29:80

http://206.166.251.4:8080

http://51.159.4.50:8080

http://167.235.70.96:8080

http://194.164.198.113:8080

http://132.145.17.167:9090

https://5.196.181.135:443

http://116.202.101.219:8080

https://185.217.98.121:443

http://185.217.98.121:8080

http://159.203.174.113:8090

http://107.161.20.142:8080

https://192.99.196.191:443

http://65.49.205.24:8080

https://154.9.207.142:443

http://67.230.176.97:8080

Extracted

Family

vidar

Version

13.4

Botnet

b67a308257f21ac98cb4828b3f69a282

C2

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

vidar

Version

13.3

Botnet

886e3178ef0cef21a6ff7125395660f2

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

bitrat

Version

1.38

C2

31.177.110.225:8080

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    Appdata

  • install_file

    FileManager

  • tor_process

    tor

Extracted

Family

vidar

Version

13.4

Botnet

f8127ecb24efc59dc898cb2fe66fd001

C2

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

  • Bitrat family
    bitrat
  • DCRat payload 1 IoCs
    rat
  • Dcrat family
    dcrat
  • Detect Poverty Stealer Payload 1 IoCs
  • Detect Vidar Stealer 4 IoCs
    stealer
  • Gurcu family
    gurcu
  • Povertystealer family
    povertystealer
  • Vidar family
    vidar
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • rihuata-main.zip
    .zip
  • rihuata-main/alopernutsa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/ausritter.exe
    .exe windows:6 windows x64 arch:x64

    b237ac2118704db9e7609540658f5790


    Code Sign

    Headers

    Imports

    Sections

  • rihuata-main/bobobopepep.exe
    .exe windows:6 windows x86 arch:x86

    351fbae162a7dacb0ecda3be35f09973


    Headers

    Imports

    Sections

  • rihuata-main/bomepratiaosa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/bvrtiawdktgawdlla.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/filesaa.pdf
    .pdf
  • rihuata-main/gopawdkrjgh.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • rihuata-main/gramiltter.exe
    .exe windows:4 windows x86 arch:x86

    0252f8597a857ddcc37d09e38ea5837d


    Headers

    Imports

    Sections

  • rihuata-main/huilter.exe
    .exe windows:6 windows x86 arch:x86

    351fbae162a7dacb0ecda3be35f09973


    Headers

    Imports

    Sections

  • rihuata-main/jaconfager.exe
    .exe windows:5 windows x86 arch:x86

    f63e2b20da57bba52ad3b39011a8e8d2


    Headers

    Imports

    Sections

  • rihuata-main/kalrtotypadjeee.exe
    .exe windows:6 windows x86 arch:x86

    351fbae162a7dacb0ecda3be35f09973


    Headers

    Imports

    Sections

  • rihuata-main/kilapopa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/klamingosa.exe
  • rihuata-main/kloalersaniii.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/kukurumalasa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/lotuserkasasa.exe
    .exe windows:6 windows x64 arch:x64

    b23a826b20a3969b3a9de8d267c2ca81


    Headers

    Imports

    Sections

  • rihuata-main/lukarakalu.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/mbnorad.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/mimamopetuesa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/mumirolepawers.exe
    .exe windows:6 windows x86 arch:x86

    351fbae162a7dacb0ecda3be35f09973


    Headers

    Imports

    Sections

  • rihuata-main/nbitoadkrtjkajdwa.exe
    .exe windows:6 windows x64 arch:x64

    b237ac2118704db9e7609540658f5790


    Code Sign

    Headers

    Imports

    Sections

  • rihuata-main/nborepadiktad.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • rihuata-main/nenruioepad.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/nixmixhix.exe
    .exe windows:6 windows x64 arch:x64

    203d63d5d9a088e2d84cef737227986b


    Headers

    Imports

    Sections

  • rihuata-main/nopekapeaaa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/nvpwadkkthaaaa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/nvtipoawdkthawd.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/oplaserkanureee.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/oprlalalalklaaa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/ripapakalswa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/tiawdkthawdaaa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/vjtkadkrihgka.exe
    .exe windows:4 windows x86 arch:x86

    0252f8597a857ddcc37d09e38ea5837d


    Headers

    Imports

    Sections

  • rihuata-main/wkerkadlrgiajda.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • rihuata-main/zuyokhrfhhfde.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • rihuata-main/zzzznoawlrgiawdaaa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections