vidar | dec_css[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
dec_css.bin
Size 137KB
Sample260403-yr8feadx2v
SHA256 c33ad557bd31598bddecf9e9d57ec0d87f1c0ae768233861fe9b24250034149b
MD5 468f02113e68f1f5e0d0159c6109d25d
SHA1 ab0f9fde50d37fb1141a86847f22696f625b3c4d
SHA512 fece67969a9a5c7d5b90ff2335b766bd31bd782fc83eb0aac7f6df5518185236b07f3cf8f5fde62f05edb5e0a8c451d0085f14282df7a29862333b1993efce96
SSDEEP 3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8QI5u:KH8RuRLlzgUd6a/AslI5u
TLSH
T128D37C117282A0B1E8472B741E7F77BDEEB04E256B908ACBE3C47D598F1A1E52371C19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer ee4724586a69cda3db87344f07509f40 vidar

Malware Config

Extracted

Family

vidar

Version

13.1

Botnet

ee4724586a69cda3db87344f07509f40

https://t.me/l793oy
https://steamcommunity.com/profiles/76561199829660832

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dec_css.bin

File Explorer

dec_css.bin

.exe 137KB

dec_css.bin

IMPHASH 351fbae162a7dacb0ecda3be35f09973
SHA256 c33ad557bd31598bddecf9e9d57ec0d87f1c0ae768233861fe9b24250034149b
MD5 468f02113e68f1f5e0d0159c6109d25d
SHA1 ab0f9fde50d37fb1141a86847f22696f625b3c4d
SHA512 fece67969a9a5c7d5b90ff2335b766bd31bd782fc83eb0aac7f6df5518185236b07f3cf8f5fde62f05edb5e0a8c451d0085f14282df7a29862333b1993efce96
SSDEEP 3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8QI5u:KH8RuRLlzgUd6a/AslI5u
TLSH
T128D37C117282A0B1E8472B741E7F77BDEEB04E256B908ACBE3C47D598F1A1E52371C19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect Vidar Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

??2@YAPAXI@Z ??3@YAXPAX@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z _splitpath atexit free isupper malloc memchr memcmp memcpy memmove memset rand srand strchr strcpy strcpy_s strlen strncpy strstr strtok_s

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess ExpandEnvironmentStringsA FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetComputerNameA GetComputerNameW GetCurrentProcessId GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetLastError GetLocalTime GetLocaleInfoA GetLogicalDriveStringsA GetLogicalProcessorInformationEx GetModuleFileNameA GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetTempPathW GetTickCount GetTimeZoneInformation GetVolumeInformationA GetWindowsDirectoryA GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize HeapAlloc HeapFree K32GetModuleFileNameExA LoadLibraryW LocalAlloc LocalFree OpenEventA OpenProcess Process32First Process32Next RaiseException ReadFile ReadProcessMemory SetFilePointer Sleep SystemTimeToFileTime TerminateProcess VirtualQueryEx WaitForSingleObject WriteFile lstrcatA lstrcpyA lstrlenA lstrlenW

advapi32

GetCurrentHwProfileA GetUserNameA GetUserNameW RegCloseKey RegEnumKeyExA RegGetValueA RegOpenKeyExA RegQueryValueExA

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

user32

CharToOemA CloseDesktop CloseWindow CreateDesktopA EnumDisplayDevicesA GetDC GetDesktopWindow GetKeyboardLayoutList GetWindowRect OpenDesktopA ReleaseDC wsprintfA wsprintfW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsprintf

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA DeleteObject GetDeviceCaps SelectObject

shell32

SHFileOperationA SHGetFolderPathA ShellExecuteExA ShellExecuteExW

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo htons recv send socket

shlwapi

PathFileExistsA PathMatchSpecA ord155 ord156 StrStrA

crypt32

CryptBinaryToStringA CryptUnprotectData

wininet

HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

dbghelp

SymMatchString

Name

.text

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

dec_css.bin

msvcrt

kernel32

advapi32

api-ms-win-crt-runtime-l1-1-0

user32

api-ms-win-crt-stdio-l1-1-0

gdi32

shell32

ole32

ws2_32

shlwapi

crypt32

wininet

bcrypt

dbghelp

generic