vidar | c06da50567f8bc32bb0df8f4648635032f5e877afc2d7b0b23d0c05d5e0358f1

Sharing

Copy URL Twitter E-mail

General

Target
Archive.tar.gz
Size 28.0MB
Sample261009-1752bsef75
SHA256 c06da50567f8bc32bb0df8f4648635032f5e877afc2d7b0b23d0c05d5e0358f1
MD5 6c175035d1292f9b36655a60a05f5601
SHA1 55809f6c5fb734db11b47ade8e4ded8887c967f3
SHA512 b1dbb7b9f30a9dcf9af8cd862ce9f5e79db939a9b7c7bf236f4d11fad7110e7bedd86f9335284db1b04289b455cd35b3eff5475041a05306296fde5d45d5c38e
SSDEEP 786432:CUiIa2AWtExMzUN1HXSwuCiajB7VUI83ZM:CUiIa2NiMzUXHXZuCiIVUFZM
TLSH
T1F257338865BC78491CEB5BDE47709BC4CC24AA449B5FAF28550E47CA30E74FB29C06F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

Botnet

787eb9876a2afb3957265ea989856480

https://172.233.152.197
https://t.me/bj00tyr
https://steamcommunity.com/profiles/76561198630398488

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Targets

- Target
  ReShade_Setup_6.8.0.exe
- Size 74KB
- SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
- MD5 f6149c4c2c189c9d27e6e55a0017a7a0
- SHA1 ed36d67f48a02c542e8f568215a14ef742527d79
- SHA512 8bfec1cee5c92417a6cbcfd05036d5de012fa95a97e2becaaf5891de7642eab5e3634081cc6e05fe87fcf0821c04ccce59cf53daf10c2941f58f638c916319e8
- SSDEEP 1536:DVRTTe6YkvCZI9NQUZzB0i6yJOvhvx0i6yJOvhvKHO5+8Tl2K:DVRTT3Ykqy9NQ6zn61vhv361vhvsO5+I
- TLSH
  T17B736A17A3694076E053063489F6CB86AA3B7953A33043CF1698A1AB1FB37C59E39774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SqlSetupBootstrapper.dll
- Size 19KB
- SHA256 4fd48245d3fd8413240764995c77276bb27bb77c8463186ecf860736c7800abe
- MD5 0158bf32d6d68277b2b9676af2fe13b3
- SHA1 26a2f9172705cc031551993baa721840a8f003ad
- SHA512 ecdde5b13cecf4d1772c913870e8b14cc68b1adf366c5a994620c64150a6b7fe52314afeb3e3345b07a74c9b9029f3c850bd01e411ddcd97f9ffc5980ceac672
- SSDEEP 384:eSigFBM0oFM8udItQmuHZ/STP1tNNNS0RaX2vN:exgFBM0oe8uiQDZ/STP1tNNN4iN
- TLSH
  T17C92B67FFB23A46DC087D2B872CECEB271F9FD444420191D4751A6303E66A649BBD682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  mfcm140.dll
- Size 6.4MB
- SHA256 d846bf2413318508c2cb1f61bd9e75730fb275a0ab1c949577f33a89f7ebe068
- MD5 b50734b7a406d3b4b8dc79a20764cc3a
- SHA1 0beead7d80cbe2399a68f664b5687ee5dd982e56
- SHA512 9d73413e9298e6d6119295356ed7e0fba8b5e18f0ad7c1914fc9e095cf0a8c6c3b5ecdcf209efead5ec89bd590f294ba65646b511f5582d7aeaa963de203b58b
- SSDEEP 196608:Nl+tWeN9K0MYTva5o8uH1UZmFtcH4EHKX+YR:NlgWe60MYTC55uH1MRJs+0
- TLSH
  T12766229FDB67D37CEBEF1A492010E95E882C4C81A91994CBCE44234D384BCE6736E5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  mfcm140u.dll
- Size 6.4MB
- SHA256 714d4011c41afb434b91ce8da15febf3bcf398f0bde3967d8891978af41e512c
- MD5 bcee50c20a56c44b78e52dee12b8a1d1
- SHA1 fc36d11d2f8422f2b87c1db23dfab415d3a23927
- SHA512 95e41314a48f2fc22bb9f0110b02168c780fef687b31ba8a34afa39515d4b2ce572096af07b2137dd74f735baffcd9210c2017628f24d6bbd89420b212c2e5eb
- SSDEEP 196608:14EHKX+V9l+tWeN9K0MYTva5rOa8ilFHLZFto:1Js+3lgWe60MYTC56a8iHe
- TLSH
  T1F16633EF5363E4E9E7EF2E4E4154DA3CC82D5892E5ACD54DDC1303A8305A9C3B22C699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ССLосitуХ64-v.6.978.exe
- Size 8.0MB
- SHA256 c85aa1fdc991830badc9cade5a7737d056a5e6198c7ee5b566650893d21cc3b3
- MD5 00f6d4dd503ea7c402bdec2a96273634
- SHA1 a4a998a07830e6362ed34880bd0dd7962ef53a70
- SHA512 10ef04de0019b3e1736c74e958578e7b14cc3901089e7de5e52ac0d6bb95d4d1d6184426f14137fc812b8607277fa2e12a051cbcf9faedf0972df7315b141971
- SSDEEP 49152:BH5FpcAIAv081d6Ur+swAkI3diiGTgiXcZEgSy:jUA1vJTvUjs5
- TLSH
  T1C886E817618410ECCA8BC27644F45D7E17F23DAE5133B78A0A95BEA12F13BD66F60E48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

787eb9876a2afb3957265ea989856480 discovery vidar network stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detects references to legitimate web services potentially used as dead drop resolvers
  Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
  network
behavioral10 behavioral9
- Target
  ReShade_Setup_6.8.0.exe
- Size 74KB
- SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
- MD5 f6149c4c2c189c9d27e6e55a0017a7a0
- SHA1 ed36d67f48a02c542e8f568215a14ef742527d79
- SHA512 8bfec1cee5c92417a6cbcfd05036d5de012fa95a97e2becaaf5891de7642eab5e3634081cc6e05fe87fcf0821c04ccce59cf53daf10c2941f58f638c916319e8
- SSDEEP 1536:DVRTTe6YkvCZI9NQUZzB0i6yJOvhvx0i6yJOvhvKHO5+8Tl2K:DVRTT3Ykqy9NQ6zn61vhv361vhvsO5+I
- TLSH
  T17B736A17A3694076E053063489F6CB86AA3B7953A33043CF1698A1AB1FB37C59E39774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SqlSetupBootstrapper.dll
- Size 19KB
- SHA256 4fd48245d3fd8413240764995c77276bb27bb77c8463186ecf860736c7800abe
- MD5 0158bf32d6d68277b2b9676af2fe13b3
- SHA1 26a2f9172705cc031551993baa721840a8f003ad
- SHA512 ecdde5b13cecf4d1772c913870e8b14cc68b1adf366c5a994620c64150a6b7fe52314afeb3e3345b07a74c9b9029f3c850bd01e411ddcd97f9ffc5980ceac672
- SSDEEP 384:eSigFBM0oFM8udItQmuHZ/STP1tNNNS0RaX2vN:exgFBM0oe8uiQDZ/STP1tNNN4iN
- TLSH
  T17C92B67FFB23A46DC087D2B872CECEB271F9FD444420191D4751A6303E66A649BBD682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  mfcm140.dll
- Size 6.4MB
- SHA256 d846bf2413318508c2cb1f61bd9e75730fb275a0ab1c949577f33a89f7ebe068
- MD5 b50734b7a406d3b4b8dc79a20764cc3a
- SHA1 0beead7d80cbe2399a68f664b5687ee5dd982e56
- SHA512 9d73413e9298e6d6119295356ed7e0fba8b5e18f0ad7c1914fc9e095cf0a8c6c3b5ecdcf209efead5ec89bd590f294ba65646b511f5582d7aeaa963de203b58b
- SSDEEP 196608:Nl+tWeN9K0MYTva5o8uH1UZmFtcH4EHKX+YR:NlgWe60MYTC55uH1MRJs+0
- TLSH
  T12766229FDB67D37CEBEF1A492010E95E882C4C81A91994CBCE44234D384BCE6736E5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  mfcm140u.dll
- Size 6.4MB
- SHA256 714d4011c41afb434b91ce8da15febf3bcf398f0bde3967d8891978af41e512c
- MD5 bcee50c20a56c44b78e52dee12b8a1d1
- SHA1 fc36d11d2f8422f2b87c1db23dfab415d3a23927
- SHA512 95e41314a48f2fc22bb9f0110b02168c780fef687b31ba8a34afa39515d4b2ce572096af07b2137dd74f735baffcd9210c2017628f24d6bbd89420b212c2e5eb
- SSDEEP 196608:14EHKX+V9l+tWeN9K0MYTva5rOa8ilFHLZFto:1Js+3lgWe60MYTC56a8iHe
- TLSH
  T1F16633EF5363E4E9E7EF2E4E4154DA3CC82D5892E5ACD54DDC1303A8305A9C3B22C699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Detects references to legitimate web services potentially used as dead drop resolvers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18