vidar | xeba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4[.]exe

General

Target
xeba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4.exe
Size 375KB
Sample260702-nms5taft3l
SHA256 eba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4
MD5 757c80c981b528922e77b8e216ecf790
SHA1 ee97649f28fec7ac7ab22ba3c4bcc480d1e9bf39
SHA512 e80dbe9e3e4388929193b006cb3a6a0a372743d115084323d671151ba261505e52ef995017ef3b923a6845b32ff1b8e79ed2f92e5416c9fda83753b7d4c79fe2
SSDEEP 3072:0V9xq+HWUk6ToXxMSJ/WyOeqoO+jjJsKqqCUmOEfV77o5gpm+NRidDVhXeOYsQoy:0ZgUk6MJuUVT29705Km5dDEsrokbK
TLSH
T15D84AE116B00D032D6235932AB6697758DFEBC302912650FFBE81E69ADF82D1DB3471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 1448 vidar

Malware Config

Extracted

Family

vidar

Version

53.1

Botnet

1448

C2

https://t.me/tg_dailyrunnings
https://mastodon.online/@olegf9844g

Attributes

profile_id
1448

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xeba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4.exe

File Explorer

xeba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4.exe

.exe 375KB

xeba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4.exe

IMPHASH fd00dc8f618c6d07bfc2d23e3460d2c1
SHA256 eba19be0c5506bdb336e0d52e89132cbecb090c050a4ced9a25550f9c1e285b4
MD5 757c80c981b528922e77b8e216ecf790
SHA1 ee97649f28fec7ac7ab22ba3c4bcc480d1e9bf39
SHA512 e80dbe9e3e4388929193b006cb3a6a0a372743d115084323d671151ba261505e52ef995017ef3b923a6845b32ff1b8e79ed2f92e5416c9fda83753b7d4c79fe2
SSDEEP 3072:0V9xq+HWUk6ToXxMSJ/WyOeqoO+jjJsKqqCUmOEfV77o5gpm+NRidDVhXeOYsQoy:0ZgUk6MJuUVT29705Km5dDEsrokbK
TLSH
T15D84AE116B00D032D6235932AB6697758DFEBC302912650FFBE81E69ADF82D1DB3471B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Vidar Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

140108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatA LocalAlloc GetProcAddress LoadLibraryA VirtualProtect FindFirstFileW FindNextFileW CompareStringW GetProcessHeap SetEndOfFile InterlockedIncrement InterlockedDecrement WideCharToMultiByte EncodePointer DecodePointer Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetLastError HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId GetTimeZoneInformation HeapSize SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType ReadFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetLocaleInfoW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW CreateFileA CreateFileW SetEnvironmentVariableA

Sharing