vidar | 02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5.exe
Size 8.2MB
Sample260528-dytwdaex5j
SHA256 02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5
MD5 ee92509e85099451fdb94f09bc2d5f94
SHA1 73bfe725641db2b381c46f601ea872c31461f72a
SHA512 abead2ca79c3612233926a42900b90817330ac26b2633da3795ccca682e4f023df939426af5ded5d612bc6096b4133381b23e3018b03696f6ae9f711f4c18433
SSDEEP 49152:cZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9Ur9AX44cg44qKlGQL:cPOkz7MVC
TLSH
T1328609AB3A708168C169813EC0938BCD97F37275773BC2E7D26107A94E096D45E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

a93ec7551f3af6e42cc58fbd67f14197 defense_evasion vidar spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

18.5

Botnet

a93ec7551f3af6e42cc58fbd67f14197

https://telegram.me/mm8hyx
https://steamcommunity.com/profiles/76561198728266687

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/4464-6-0x0000000140000000-0x0000000140102000-memory.dmp	family_vidar_v15

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5.exe

C:\Users\Admin\AppData\Local\Temp\02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5.exe
"C:\Users\Admin\AppData\Local\Temp\02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5.exe"
1⤵
- Modifies system certificate store
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4464-0-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4464-1-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4464-5-0x0000000004DC0000-0x00000000050B4000-memory.dmp

Download

memory/4464-6-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4464-19-0x0000000004DC0000-0x00000000050B4000-memory.dmp

Download

memory/4464-18-0x0000000000400000-0x0000000000C43000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads