Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

file.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 556KB
  • Sample261003-ylhmsswerc
  • SHA256 1aa59edff3c33ebff948fdfa1aca7aad97f248b3275a31e587c40c0f852b8114
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidard362134c0f45c0b85d054070aa6ab3aedefense_evasiondiscoveryprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 3.7

Botnet

  • d362134c0f45c0b85d054070aa6ab3ae

C2

  • https://79.133.42.171

  • https://telegram.me/bj00tyr

  • https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=64444700

  • https://steamcommunity.com/profiles/76561198630398488

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Targets

    • Target
      file.exe
    • Size 556KB
    • SHA256 1aa59edff3c33ebff948fdfa1aca7aad97f248b3275a31e587c40c0f852b8114
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    d362134c0f45c0b85d054070aa6ab3aedefense_evasiondiscoveryvidarprivilege_escalationspywarestealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Suspicious use of NtCreateProcessExOtherParentProcess

      defense_evasionprivilege_escalation

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks