Overview

overview

10

Static

static

10

2026-04-19...op.exe

windows10-2004-x64

10

2026-04-19...op.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-19_b9416e2c7353d3bb8be7ea1a7139d397_amadey_elex_mafia_smoke-loader_stop
  • Size 10.1MB
  • Sample260419-thnmesbw41
  • SHA256 e944dc3ee0776e3ee230c680424a7096f519c6a99e1efd12f52fc9d3967525c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidar1281discoverystealervmprotect

Malware Config

Extracted

Family

  • vidar

Version

  • 52.6

Botnet

  • 1281

C2

  • https://t.me/tg_dailylessons

  • https://busshi.moe/@olegf9844xx

Attributes
  • profile_id

    1281

Targets

    • Target
      2026-04-19_b9416e2c7353d3bb8be7ea1a7139d397_amadey_elex_mafia_smoke-loader_stop
    • Size 10.1MB
    • SHA256 e944dc3ee0776e3ee230c680424a7096f519c6a99e1efd12f52fc9d3967525c0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryvidarstealervmprotect

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables packed with VMProtect.

    • Vidar Stealer

      stealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks