Overview

overview

10

Static

static

5

UI/VCRUNTIME140.dll

windows10-2004-x64

1

UI/VCRUNTIME140.dll

windows11-21h2-x64

1

UI/VCRUNTIME140_1.dll

windows10-2004-x64

1

UI/VCRUNTIME140_1.dll

windows11-21h2-x64

1

UI/Xeno.exe

windows10-2004-x64

10

UI/Xeno.exe

windows11-21h2-x64

10

UI/glib-2.0.dll

windows10-2004-x64

1

UI/glib-2.0.dll

windows11-21h2-x64

1

UI/gmodule-2.0.dll

windows10-2004-x64

1

UI/gmodule-2.0.dll

windows11-21h2-x64

1

UI/gobject-2.0.dll

windows10-2004-x64

1

UI/gobject-2.0.dll

windows11-21h2-x64

1

UI/intl.dll

windows10-2004-x64

1

UI/intl.dll

windows11-21h2-x64

1

UI/locales...ng.dll

windows10-2004-x64

1

UI/locales...ng.dll

windows11-21h2-x64

1

UI/locales...ng.dll

windows10-2004-x64

1

UI/locales...ng.dll

windows11-21h2-x64

1

UI/locales...ng.dll

windows10-2004-x64

1

UI/locales...ng.dll

windows11-21h2-x64

1

UI/pcre.dll

windows10-2004-x64

1

UI/pcre.dll

windows11-21h2-x64

1

UI/vmtools.dll

windows10-2004-x64

1

UI/vmtools.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    UI.zip
  • Size 5.3MB
  • Sample260616-rdtxjaey3z
  • SHA256 adf654ae200ee657038c10afce2bdc3408dc983c0e32fa589abe3766f3ee5e4b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidar30a67e0c5ea1f5a62073441175706e05stealer

Malware Config

Extracted

Family

  • vidar

Version

  • 18.3

Botnet

  • 30a67e0c5ea1f5a62073441175706e05

C2

  • https://74.0.48.37

  • https://telegram.me/m0r5hl

  • https://steamcommunity.com/profiles/76561198733506974

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Targets

    • Target
      UI/VCRUNTIME140.dll
    • Size 83KB
    • SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      UI/VCRUNTIME140_1.dll
    • Size 48KB
    • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      UI/Xeno.exe
    • Size 108KB
    • SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    30a67e0c5ea1f5a62073441175706e05vidarstealer

    • Detects Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar
    behavioral5behavioral6
    • Target
      UI/glib-2.0.dll
    • Size 1.2MB
    • SHA256 29f281e0e9ebc9cc7b54af08535509feac1930a60d3d2e2fe9528f77711f04a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      UI/gmodule-2.0.dll
    • Size 29KB
    • SHA256 ed105b46d3a374db93cc79ce058e897b63dfce9bcc3a27d93ab8f254baeae58a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      UI/gobject-2.0.dll
    • Size 293KB
    • SHA256 2c76ddda266dbada9597eec8d7559b0669c25f2037344c19b4807e4d61b6dcfe
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      UI/intl.dll
    • Size 2.5MB
    • SHA256 cfb08e9ec7f6b48ea239cb9e1677f4c5deaf7ef9f2ab81e021b6f9e6da8766e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      UI/locales/resources/app.asar.unpacked/node_modules/btime/binding.node
    • Size 118KB
    • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      UI/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
    • Size 125KB
    • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      UI/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
    • Size 118KB
    • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      UI/pcre.dll
    • Size 402KB
    • SHA256 67332a8c1fa3a2bb449aea74cbcff3c64754fafb09c273ae51bafac91deac340
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      UI/vmtools.dll
    • Size 867KB
    • SHA256 dbee15d75e4bfc40a0091878009dedf0cca795f224554c91ad776710eb3a76a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix

Tasks