Overview

overview

10

Static

static

3

2026-07-29...ee.exe

windows10-2004-x64

10

2026-07-29...ee.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 279KB
  • Sample260729-ph8kdage23
  • SHA256 afcc0fe0aaab5c1a5d96d05538cd6dd0b638ddbc775c0f1cef1ee08060669ab8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidar654e6a65f356e43f90c165a3f9ff6b60defense_evasiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

  • vidar

Version

  • 6.2

Botnet

  • 654e6a65f356e43f90c165a3f9ff6b60

C2

  • https://steamcommunity.com/profiles/76561199564671869

  • https://t.me/scubytale

Attributes
  • profile_id_v2

    654e6a65f356e43f90c165a3f9ff6b60

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0

Targets

    • Target
      2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
    • Size 279KB
    • SHA256 afcc0fe0aaab5c1a5d96d05538cd6dd0b638ddbc775c0f1cef1ee08060669ab8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    654e6a65f356e43f90c165a3f9ff6b60discoveryvidarstealerdefense_evasionspywaretrojan

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects Windows executables referencing non-Windows User-Agents

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks