Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
15/12/2025, 19:35
General
- Target msedge_elf.dll
- Size 9.9MB
- Sample251215-yav4raymex
- SHA256 7f842a8c29d21c6e1948ea8cb8945a1098b54d848fb68ea4016bfb5d4ecc6108
Score
10/10
Malware Config
Extracted
Family
-
vidar
Botnet
-
ac70d64d0ec384442d9661eff8142c71
Campaign
-
cego54
C2
-
https://telegram.me/cego54
Signatures
- Detects Vidar Stealer 2 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msedge_elf.dll,#11⤵
- Badlisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2024-0-0x0000000140000000-0x0000000140189000-memory.dmp
memory/2024-1-0x0000000140000000-0x0000000140189000-memory.dmp
memory/2024-14-0x0000000140000000-0x0000000140189000-memory.dmp
memory/2024-13-0x00007FFAD6880000-0x00007FFAD70BB000-memory.dmp
memory/2024-20-0x00007FFAD6880000-0x00007FFAD70BB000-memory.dmp
memory/2024-26-0x00007FFAD6880000-0x00007FFAD70BB000-memory.dmp