vidar | 4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin.exe
Size 121KB
Sample260705-nwtspsb19v
SHA256 4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae
MD5 4de734c2a865966c5c77569ea7377852
SHA1 3c8b5cb8e6031bbc5a0ce5c6991b9fcab3133a5c
SHA512 d05203150ce9b920512fed90ecb6d98468f8f4ae958b8f4d2e97cd1e21fa246c0630d9c75690687b5a3bac41ad40fb79b32d6696d107292e1cb0eba93020c53f
SSDEEP 3072:6EFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXBB:J3h0aMJ+Hw3Pgen79/GvR
TLSH
T1A3C36D5A7752E0B2E48D2375523E377DCEB09F353CA0CAAFDF803D0A9E29190525616B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 118972aafa1c94d5e6362d5d7b5757a3 vidar

Malware Config

Extracted

Family

vidar

Version

12.8

Botnet

118972aafa1c94d5e6362d5d7b5757a3

https://t.me/sok33tn
https://steamcommunity.com/profiles/76561199824159981

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
sample	family_vidar_v7

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin.exe

File Explorer

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin.exe

.exe 121KB

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin.exe

IMPHASH 88967e8dc94c2149dd89b55f39e46fa6
SHA256 4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae
MD5 4de734c2a865966c5c77569ea7377852
SHA1 3c8b5cb8e6031bbc5a0ce5c6991b9fcab3133a5c
SHA512 d05203150ce9b920512fed90ecb6d98468f8f4ae958b8f4d2e97cd1e21fa246c0630d9c75690687b5a3bac41ad40fb79b32d6696d107292e1cb0eba93020c53f
SSDEEP 3072:6EFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXBB:J3h0aMJ+Hw3Pgen79/GvR
TLSH
T1A3C36D5A7752E0B2E48D2375523E377DCEB09F353CA0CAAFDF803D0A9E29190525616B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect Vidar Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb

msvcrt

??2@YAPAXI@Z ??3@YAXPAX@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z _itoa_s _splitpath atexit free isupper malloc memchr memcmp memcpy memmove memset rand srand strchr strcpy strcpy_s strlen strncpy strstr strtok_s

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess ExpandEnvironmentStringsA FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetComputerNameA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetLastError GetLocalTime GetLocaleInfoA GetLogicalDriveStringsA GetLogicalProcessorInformationEx GetModuleFileNameA GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetTempPathW GetTickCount GetTimeZoneInformation GetVolumeInformationA GetWindowsDirectoryA GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize HeapAlloc HeapFree K32GetModuleFileNameExA LoadLibraryW LocalAlloc LocalFree OpenEventA OpenProcess Process32First Process32Next RaiseException ReadFile ReadProcessMemory SetFilePointer Sleep SystemTimeToFileTime TerminateProcess VirtualQueryEx WaitForSingleObject WriteFile lstrcatA lstrcpyA lstrlenA lstrlenW

advapi32

GetCurrentHwProfileA GetUserNameA GetUserNameW RegCloseKey RegEnumKeyExA RegGetValueA RegOpenKeyExA RegQueryValueExA

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

user32

CharToOemA CloseDesktop CloseWindow CreateDesktopA EnumDisplayDevicesA GetDC GetDesktopWindow GetKeyboardLayoutList GetWindowRect MessageBoxA OpenDesktopA ReleaseDC wsprintfA wsprintfW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsprintf

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA DeleteObject GetDeviceCaps SelectObject

shell32

SHFileOperationA SHGetFolderPathA ShellExecuteExA ShellExecuteExW

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo htons recv send socket

shlwapi

PathFileExistsA PathMatchSpecA ord155 ord156 StrStrA

crypt32

CryptBinaryToStringA CryptUnprotectData

wininet

HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymInitialize SymMatchString SymSetOptions

Name

.text

Size

95KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin.exe

msvcrt

kernel32

advapi32

api-ms-win-crt-runtime-l1-1-0

user32

api-ms-win-crt-stdio-l1-1-0

gdi32

shell32

ole32

ws2_32

shlwapi

crypt32

wininet

bcrypt

dbghelp

generic