vidar | d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc

max time kernel
149s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Size 1.1MB
Sample260712-p5a8dsas8k
SHA256 d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc
MD5 1ecbe08e98d64f9f39848b939710e560
SHA1 00a618d18552efe1ce68b0ed526e4a447e8333bf
SHA512 186ba338686f7517a56e15921a407bbed24492b7ca6c4dd5c563447939ffecf4dc08853f9ce95dcc49e20659c83075fbdab8c515c0e3e38cbd061df0a72c183a
SSDEEP 24576:Yna4qO2uUWyu2czCieYdBQdtsqha1odDSwwOOa:YnKO2ox1eYdudOqiolSwwOOa
TLSH
T15D45E196B7E503F5E1B3D179CA958E42FAB2B8450720A7C703E496B12F136D15E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ebf46513ca28013c559d967cdb3a7740 vidar stealer

Malware Config

Extracted

Family

vidar

Extracted

Family

vidar

Version

16.6

Botnet

ebf46513ca28013c559d967cdb3a7740

https://steamcommunity.com/profiles/76561198770591383

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0

Extracted

Family

vidar

Version

t_.k

Botnet

ebf46513ca28013c559d967cdb3a7740

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral27/memory/3720-2-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral27/memory/3720-4-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral27/memory/3720-5-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral27/memory/3720-6-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral27/memory/3720-18-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83
PID 3848 wrote to memory of 3720	3848	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	83

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
  "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe"
  2⤵
  PID:3720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3720-1-0x0000013023B00000-0x0000013023B01000-memory.dmp

Download

memory/3720-2-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/3720-4-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/3720-5-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/3720-6-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/3720-18-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/3848-0-0x00007FFC29ED0000-0x00007FFC2A0C5000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads