vidar | d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc

max time kernel
148s
max time network
183s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Size 1.1MB
Sample260712-p5a8dsas8k
SHA256 d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc
MD5 1ecbe08e98d64f9f39848b939710e560
SHA1 00a618d18552efe1ce68b0ed526e4a447e8333bf
SHA512 186ba338686f7517a56e15921a407bbed24492b7ca6c4dd5c563447939ffecf4dc08853f9ce95dcc49e20659c83075fbdab8c515c0e3e38cbd061df0a72c183a
SSDEEP 24576:Yna4qO2uUWyu2czCieYdBQdtsqha1odDSwwOOa:YnKO2ox1eYdudOqiolSwwOOa
TLSH
T15D45E196B7E503F5E1B3D179CA958E42FAB2B8450720A7C703E496B12F136D15E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ebf46513ca28013c559d967cdb3a7740 vidar stealer

Malware Config

Extracted

Family

vidar

Extracted

Family

vidar

Version

16.6

Botnet

ebf46513ca28013c559d967cdb3a7740

https://steamcommunity.com/profiles/76561198770591383

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0

Extracted

Family

vidar

Version

t_.k

Botnet

ebf46513ca28013c559d967cdb3a7740

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral28/memory/5092-2-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral28/memory/5092-4-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral28/memory/5092-6-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral28/memory/5092-7-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15
behavioral28/memory/5092-39-0x0000000140000000-0x00000001400D2000-memory.dmp	family_vidar_v15

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86
PID 3240 wrote to memory of 5092	3240	d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe	86

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
  "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe"
  2⤵
  PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x00007FF8E0460000-0x00007FF8E06C3000-memory.dmp

Download

memory/5092-1-0x000002B00FC70000-0x000002B00FC71000-memory.dmp

Download

memory/5092-2-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/5092-4-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/5092-6-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/5092-7-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

memory/5092-39-0x0000000140000000-0x00000001400D2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads