vidar | 4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.zip
Size 63KB
Sample260705-16282sf14y
SHA256 b36c7b1e2cc085b41f01ae8aeb7bed6f0ad8f3616bdcea140d3ef8ab95bcf839
MD5 d4a99a58bd47ba54e3459a240ea27f68
SHA1 893988cac1dbbf0265c55d01c8baac7042d11f18
SHA512 3f94c240aa6354bb6b528dfa9cb192be9794e7d08254a052d948b24db40e0ade5e2f9bfaec7c488af4a82c38e6e490947fb9da1f88676da9a6c7c74c773b1501
SSDEEP 1536:Wt9ChdJukRMJzrDAjc85hMkJQf7yBJRsgD0I1/P8:WHCXkk4zAjc8YkJQfmJFDh8
TLSH
T1D75312E4B8447CBBCE6747142B2DB3068A1362D6DC68686C71FFEB6650845308B3F298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 118972aafa1c94d5e6362d5d7b5757a3 vidar

Malware Config

Extracted

Family

vidar

Version

12.8

Botnet

118972aafa1c94d5e6362d5d7b5757a3

https://t.me/sok33tn
https://steamcommunity.com/profiles/76561199824159981

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
static1/unpack001/4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.exe	family_vidar_v7

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.exe

File Explorer

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.zip

.zip 63KB
4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.exe

.exe 121KB

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.zip

SHA256 b36c7b1e2cc085b41f01ae8aeb7bed6f0ad8f3616bdcea140d3ef8ab95bcf839
MD5 d4a99a58bd47ba54e3459a240ea27f68
SHA1 893988cac1dbbf0265c55d01c8baac7042d11f18
SHA512 3f94c240aa6354bb6b528dfa9cb192be9794e7d08254a052d948b24db40e0ade5e2f9bfaec7c488af4a82c38e6e490947fb9da1f88676da9a6c7c74c773b1501
SSDEEP 1536:Wt9ChdJukRMJzrDAjc85hMkJQf7yBJRsgD0I1/P8:WHCXkk4zAjc8YkJQfmJFDh8
TLSH
T1D75312E4B8447CBBCE6747142B2DB3068A1362D6DC68686C71FFEB6650845308B3F298
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.exe

IMPHASH 88967e8dc94c2149dd89b55f39e46fa6
SHA256 4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae
MD5 4de734c2a865966c5c77569ea7377852
SHA1 3c8b5cb8e6031bbc5a0ce5c6991b9fcab3133a5c
SHA512 d05203150ce9b920512fed90ecb6d98468f8f4ae958b8f4d2e97cd1e21fa246c0630d9c75690687b5a3bac41ad40fb79b32d6696d107292e1cb0eba93020c53f
SSDEEP 3072:6EFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXBB:J3h0aMJ+Hw3Pgen79/GvR
TLSH
T1A3C36D5A7752E0B2E48D2375523E377DCEB09F353CA0CAAFDF803D0A9E29190525616B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect Vidar Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb

msvcrt

??2@YAPAXI@Z ??3@YAXPAX@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z _itoa_s _splitpath atexit free isupper malloc memchr memcmp memcpy memmove memset rand srand strchr strcpy strcpy_s strlen strncpy strstr strtok_s

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess ExpandEnvironmentStringsA FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetComputerNameA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetLastError GetLocalTime GetLocaleInfoA GetLogicalDriveStringsA GetLogicalProcessorInformationEx GetModuleFileNameA GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetTempPathW GetTickCount GetTimeZoneInformation GetVolumeInformationA GetWindowsDirectoryA GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize HeapAlloc HeapFree K32GetModuleFileNameExA LoadLibraryW LocalAlloc LocalFree OpenEventA OpenProcess Process32First Process32Next RaiseException ReadFile ReadProcessMemory SetFilePointer Sleep SystemTimeToFileTime TerminateProcess VirtualQueryEx WaitForSingleObject WriteFile lstrcatA lstrcpyA lstrlenA lstrlenW

advapi32

GetCurrentHwProfileA GetUserNameA GetUserNameW RegCloseKey RegEnumKeyExA RegGetValueA RegOpenKeyExA RegQueryValueExA

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

user32

CharToOemA CloseDesktop CloseWindow CreateDesktopA EnumDisplayDevicesA GetDC GetDesktopWindow GetKeyboardLayoutList GetWindowRect MessageBoxA OpenDesktopA ReleaseDC wsprintfA wsprintfW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsprintf

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA DeleteObject GetDeviceCaps SelectObject

shell32

SHFileOperationA SHGetFolderPathA ShellExecuteExA ShellExecuteExW

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo htons recv send socket

shlwapi

PathFileExistsA PathMatchSpecA ord155 ord156 StrStrA

crypt32

CryptBinaryToStringA CryptUnprotectData

wininet

HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymInitialize SymMatchString SymSetOptions

Name

.text

Size

95KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.zip

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.exe

msvcrt

kernel32

advapi32

api-ms-win-crt-runtime-l1-1-0

user32

api-ms-win-crt-stdio-l1-1-0

gdi32

shell32

ole32

ws2_32

shlwapi

crypt32

wininet

bcrypt

dbghelp

generic