vidar | 39224f93ebeda1628adea0671a4dcf92e504debd29b86d9511ad5b3f73657875

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_39224f93ebeda1628adea0671a4dcf92e504debd29b86d9511ad5b3f73657875.bin
Size 18.7MB
Sample260922-qa2brsfa45
SHA256 39224f93ebeda1628adea0671a4dcf92e504debd29b86d9511ad5b3f73657875
MD5 2e09d0dd29e515a8fc51136b76be3ed2
SHA1 83ef6fc159d67074b22d4e0b2198c3f27f38fbb4
SHA512 3af7b99813793bd515578fb211db48338737299d5b9cd12d88f868c14f79d77cd5bd999f6c6cfe0b6a5008f4a82e05156d7782a7535ff9ea59704ba7b03f27d4
SSDEEP 393216:bVNHwf72Rq5t6hRdL5t6hRdDefvLM5t6hRdr8k2LU1k9DMM/:/yWhrLWhrE4WhrrMY1U
TLSH
T11F173369D52A422DF4DE62B0D4564F21B361C9D838D453BB27B2278E4DD2B970EC3F88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

Botnet

1391

http://82.115.223.60:80

Attributes

profile_id
1391

Targets

- Target
  Evil_Launcher_Beta-win_x64.exe
- Size 700.0MB
- SHA256 83584b80474ab39d7604629bceb36de84ef88f2d5a4406e2478e1839c6d566eb
- MD5 7b0172f73dd3cd5ad11d542865a6e4be
- SHA1 b503efe0eb2ed5f62e46adfadc4d2b1e1a5d943c
- SHA512 b5f6c4c57ac8e60c0fda6827bbea205fb029160b8bcce876c27e30e563054616c75aae31a1aa5a929de23e075a9705481bc3f0cec157a37521ffb046552edfdd
- SSDEEP 49152:m4qP1cgiZSkmKKug/ItTJWLAE/g2w1Qix+nfwSullcjl76+9jlNo:sFiZSygMJoN2ZlmNt5lG
- TLSH
  T18979BEF4A1FB8092F5479D81243CF9E205B231A3ADCA0D38176ABA04DFEFD543945A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

1391 discovery vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  LauncherUpdate.json
- Size 4KB
- SHA256 811e09019ca5fddbfd861fc260bb81674b2e03cbaf981641be588d368fdff64b
- MD5 c1b99e8a84c32550dad27c6cfdac51a3
- SHA1 61c9d64b184959532082c2708718e46765fb3923
- SHA512 d804df6738b7f5bb2148fdfbfa41f9757d577e83ef0f95e36dc91a9f4f293bb59d85a9550dda76c2c60f37e5512be4a46eda369baefbdf1f36c57f037f7d4eb7
- SSDEEP 96:HOqFuIzlKOqFuIzlKOqFuIzlKOqFuIzlKOqFuIzlKOqFuIzlG:HOqFuIEOqFuIEOqFuIEOqFuIEOqFuIEw
- TLSH
  T109A18E16A1F26707C8B6B27E068FEC6FB6D1E800060FAE35390C42412F34492AA69C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  bin/wmic_centos_x64
- Size 6.4MB
- SHA256 54d9da61a4ebf744cf8443b03c5a765ca3c53a4bc81cb27afd40a84d5030e99d
- MD5 fa144d6aafcc786b810dd8e52b4b1d1a
- SHA1 02de4e1441883223b8ebcff83d0a300797c842b8
- SHA512 485c1f6856ad9c83fe13de4aa5540c9f5129014320b6975f642103cbc60cfb8434b3b4af1bf24e515765d9d6c93ae85d58cc86ec621547b149cd0e9413d790fe
- SSDEEP 49152:Tg3ATcnnxGb/V6Qhzxwi3P9ppULbDBGcdxWngwJksjQUlPqrAbndGi/J7FJE9HBx:UwsEbVibdG3zjrlNW3X/OqFGJ
- TLSH
  T13266703A67A2838CE04BF1342BDE96A2AC6475F10174714F025D0D1AAF76ED14B9EBD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  bin/wmic_ubuntu_x64
- Size 6.4MB
- SHA256 54d9da61a4ebf744cf8443b03c5a765ca3c53a4bc81cb27afd40a84d5030e99d
- MD5 fa144d6aafcc786b810dd8e52b4b1d1a
- SHA1 02de4e1441883223b8ebcff83d0a300797c842b8
- SHA512 485c1f6856ad9c83fe13de4aa5540c9f5129014320b6975f642103cbc60cfb8434b3b4af1bf24e515765d9d6c93ae85d58cc86ec621547b149cd0e9413d790fe
- SSDEEP 49152:Tg3ATcnnxGb/V6Qhzxwi3P9ppULbDBGcdxWngwJksjQUlPqrAbndGi/J7FJE9HBx:UwsEbVibdG3zjrlNW3X/OqFGJ
- TLSH
  T13266703A67A2838CE04BF1342BDE96A2AC6475F10174714F025D0D1AAF76ED14B9EBD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  swiftshader/wmic_centos_x64
- Size 6.4MB
- SHA256 54d9da61a4ebf744cf8443b03c5a765ca3c53a4bc81cb27afd40a84d5030e99d
- MD5 fa144d6aafcc786b810dd8e52b4b1d1a
- SHA1 02de4e1441883223b8ebcff83d0a300797c842b8
- SHA512 485c1f6856ad9c83fe13de4aa5540c9f5129014320b6975f642103cbc60cfb8434b3b4af1bf24e515765d9d6c93ae85d58cc86ec621547b149cd0e9413d790fe
- SSDEEP 49152:Tg3ATcnnxGb/V6Qhzxwi3P9ppULbDBGcdxWngwJksjQUlPqrAbndGi/J7FJE9HBx:UwsEbVibdG3zjrlNW3X/OqFGJ
- TLSH
  T13266703A67A2838CE04BF1342BDE96A2AC6475F10174714F025D0D1AAF76ED14B9EBD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  swiftshader/wmic_ubuntu_x64
- Size 11.5MB
- SHA256 77061ecbd48a394af11c3e5d23e66846f99d28fa67fe9dbb3a805f98a01fea52
- MD5 606358b029d57d9cd9530d4b9494dc34
- SHA1 059dab4840cecac709125882b27bcb448aae3700
- SHA512 65f765c757c3c0ce13971f1ba2e5ebe5977f0715cb73946ad4ca598ece1bf60131fe0b0ddbf960699a8ade24f64a2f3d67d1a1cf7840bcf0b19eb1b1a9b80ae7
- SSDEEP 196608:cZ3gc1BsZUr1ssGRhUpRr9zM7tWG5/2Xm:cZ3bJr1ssGEr9M7tWG5/2Xm
- TLSH
  T1B0C61A773752835DE51AF2B227EB4093EE20B0F93264704F535D891A6F16B880E4BDE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8