Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

file.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 1.4MB
  • Sample260409-n8xecsft3m
  • SHA256 232767e3b2a84bc3a906a8eef2cccffcf9d21cf1eda388ed2b805ff90b4922a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
snappyclientvidar352c94bbdfa1a2947327cb8bcb6d0e9bbackdoorcollectiondiscoverypersistencestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 1.1

Botnet

  • 352c94bbdfa1a2947327cb8bcb6d0e9b

C2

  • https://t.me/koekoef

  • https://telegram.me/nwwfh8

  • https://steamcommunity.com/profiles/76561198719385745

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

  • snappyclient

Attributes
  • additional_fields

    false

  • buildID

    main

  • cache_directory

    eiio

  • default_directory

    %ALLUSERSPROFILE%\Dodic

  • directory

    Tagigumo

  • events_db

    Leliluku

  • keylogger_file

    Hayova

  • shared_memory

    true

  • software_db

    Sujafo

  • tag

    LDC

Targets

    • Target
      file.exe
    • Size 1.4MB
    • SHA256 232767e3b2a84bc3a906a8eef2cccffcf9d21cf1eda388ed2b805ff90b4922a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    352c94bbdfa1a2947327cb8bcb6d0e9bdiscoveryvidarstealerbackdoorcollectionsnappyclientpersistence

    • Detects Vidar Stealer

      stealer

    • SnappyClient

      SnappyClient is a C2 framework with information stealing capabilities, written in C++.

      backdoorstealersnappyclient

    • Snappyclient family

      snappyclient

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks