Overview

overview

10

Static

static

10

3de02e03f9...cb.exe

windows10-2004-x64

10

3de02e03f9...cb.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3de02e03f9890e8b6707cfdcaabf5cc829d284209f54fb8496fb7ef2dd36dfcb.bin
  • Size 281KB
  • Sample260727-bn55jstfjf
  • SHA256 3de02e03f9890e8b6707cfdcaabf5cc829d284209f54fb8496fb7ef2dd36dfcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidare17ffe2915579edda29a02873e38e32dcredential_accessdefense_evasiondiscoveryexecutionspywarestealertrojan

Malware Config

Extracted

Family

  • vidar

Version

  • 10.9

Botnet

  • e17ffe2915579edda29a02873e38e32d

C2

  • https://t.me/fneogr

  • https://t.me/edm0d

  • https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Targets

    • Target
      3de02e03f9890e8b6707cfdcaabf5cc829d284209f54fb8496fb7ef2dd36dfcb.bin
    • Size 281KB
    • SHA256 3de02e03f9890e8b6707cfdcaabf5cc829d284209f54fb8496fb7ef2dd36dfcb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    e17ffe2915579edda29a02873e38e32dcredential_accessdefense_evasiondiscoveryexecutionvidarspywarestealertrojan

    • Detect Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks