Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 18:46
General
- Target intl.dll
- Size 2.9MB
- Sample260418-xe5cjsdz2w
- SHA256 db49759309c946efb1f2d7b9a2efec86f3f94a52e2c450f47bf10a7000d1172f
Malware Config
Extracted
-
vidar
-
18.2
-
caa4010d1f95fc60b3d3dc9e5357aa1b
-
https://74.0.48.48
-
https://telegram.me/pr55ii
-
https://steamcommunity.com/profiles/76561198735736086
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Vidar Stealer 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\intl.dll,#11⤵
- Badlisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3400-0-0x0000000140000000-0x00000001400EE000-memory.dmp
memory/3400-1-0x0000000140000000-0x00000001400EE000-memory.dmp
memory/3400-13-0x00007FFAAD200000-0x00007FFAAD504000-memory.dmp
memory/3400-15-0x0000000140000000-0x00000001400EE000-memory.dmp
memory/3400-14-0x0000024BFFBF0000-0x0000024BFFC9E000-memory.dmp
memory/3400-39-0x0000024BFFBF0000-0x0000024BFFC9E000-memory.dmp
memory/3400-38-0x00007FFAAD200000-0x00007FFAAD504000-memory.dmp