Overview

overview

10

Static

static

10

#!~#0Pen_4...up.exe

windows10-2004-x64

10

#!~#0Pen_4...up.exe

windows10-ltsc_2021-x64

10

#!~#0Pen_4...up.exe

windows11-21h2-x64

10

#!~#0Pen_4...up.exe

windows11-ltsc_2024-x64

10

Resubmissions

26/08/2026, 11:58

260826-n456psycpb10

14/06/2024, 14:13

240614-rjd39sxfmp10

Sharing

Copy URL Twitter E-mail

General

  • Target
    #!~#0Pen_4422_P@$SW0rd~!!$.zip
  • Size 8.9MB
  • Sample260826-n456psycpb
  • SHA256 04e78ecfe607fbbea63c548deac4a45403a4ce44ffa35a6e858bcbf4b09e7bdf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadervidarcredential_accessdefense_evasiondiscoveryexecutionloaderpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\Httva

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

  • vidar

C2

  • https://feeldog.xyz

  • https://t.me/memve4erin

  • https://steamcommunity.com/profiles/76561199699680841

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Targets

    • Target
      #!~#0Pen_4422_P@$SW0rd~!!$/Setup.exe
    • Size 94KB
    • SHA256 040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionvidarpersistenceprivilege_escalationspywarestealer

    • Detect Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks