Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
29/07/2026, 12:20
General
- Target 2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 279KB
- Sample260729-ph8kdage23
- SHA256 afcc0fe0aaab5c1a5d96d05538cd6dd0b638ddbc775c0f1cef1ee08060669ab8
Malware Config
Extracted
-
vidar
-
6.2
-
654e6a65f356e43f90c165a3f9ff6b60
-
https://steamcommunity.com/profiles/76561199564671869
-
https://t.me/scubytale
-
profile_id_v2
654e6a65f356e43f90c165a3f9ff6b60
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1772-2-0x0000000002530000-0x000000000257E000-memory.dmp
memory/1772-1-0x00000000008C0000-0x00000000009C0000-memory.dmp
memory/1772-5-0x0000000002530000-0x000000000257E000-memory.dmp
memory/1772-4-0x00000000008C0000-0x00000000009C0000-memory.dmp
memory/1772-3-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/1772-15-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/1772-18-0x0000000000400000-0x00000000007CE000-memory.dmp