General
- Target https://omgxplolts.com:443/nexomia
- Sample260826-dh8dtsytas
Score
10/10
Malware Config
Extracted
Family
-
vidar
Version
-
3.1
Botnet
-
a6d2471547d36419d2976bfb5f58f7b6
C2
-
https://77.42.69.149
-
https://telegram.me/s11yne
-
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=roAjr
-
https://steamcommunity.com/profiles/76561198652917381
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0
Targets
-
- Target https://omgxplolts.com:443/nexomia
Score10/10-
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.