Overview

overview

9

Static

static

3

2025-07-08...ar.exe

windows10-2004-x64

9

2025-07-08...ar.exe

windows11-21h2-x64

9

Resubmissions

08/07/2025, 13:47

250708-q3xt2seq4t9

08/07/2025, 05:07

250708-fr3wtatthz9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-07-08_6c4fa3e0eedb3100f4757bd2172bec9f_conti_vidar
  • Size 243KB
  • Sample250708-fr3wtatthz
  • SHA256 14468d1a661ce6296e3b0ee696d8c95b3798138668463e142046c056fb870b68
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target
      2025-07-08_6c4fa3e0eedb3100f4757bd2172bec9f_conti_vidar
    • Size 243KB
    • SHA256 14468d1a661ce6296e3b0ee696d8c95b3798138668463e142046c056fb870b68
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    credential_accessdiscoveryransomwarespywarestealer

    • Renames multiple (8436) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks