General
-
Target
4aff771e5595904d0d6a10f74910aeb1f68e6ec34e8a2e74e915b78139a90b95
-
Size
2.2MB
-
Sample
240701-h629yasdqk
-
MD5
d7186946ba0926a9bdbdcb33ab59768d
-
SHA1
36efd4957378955206d44495e76a7f27921cf14f
-
SHA256
4aff771e5595904d0d6a10f74910aeb1f68e6ec34e8a2e74e915b78139a90b95
-
SHA512
64b76b93cc59a0a88b5f5050dcf375032574d80b534a44252dd7e8d857b3a041efe67416c57201302aab4552b7acad909b268f8164865c680035a4896064002c
-
SSDEEP
24576:Uc0PyhhGkCI1wUL24jtYkYGbawg757CgXueAgXfqU2MZQti1u8LnsDJY6WpEYGYG:UJ0hsA91MPp21tuuIeNHYGY0LzjsJxK
Static task
static1
Behavioral task
behavioral1
Sample
4aff771e5595904d0d6a10f74910aeb1f68e6ec34e8a2e74e915b78139a90b95.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Targets
-
-
Target
4aff771e5595904d0d6a10f74910aeb1f68e6ec34e8a2e74e915b78139a90b95
-
Size
2.2MB
-
MD5
d7186946ba0926a9bdbdcb33ab59768d
-
SHA1
36efd4957378955206d44495e76a7f27921cf14f
-
SHA256
4aff771e5595904d0d6a10f74910aeb1f68e6ec34e8a2e74e915b78139a90b95
-
SHA512
64b76b93cc59a0a88b5f5050dcf375032574d80b534a44252dd7e8d857b3a041efe67416c57201302aab4552b7acad909b268f8164865c680035a4896064002c
-
SSDEEP
24576:Uc0PyhhGkCI1wUL24jtYkYGbawg757CgXueAgXfqU2MZQti1u8LnsDJY6WpEYGYG:UJ0hsA91MPp21tuuIeNHYGY0LzjsJxK
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-