Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 15:38
General
- Target 2026-08-01_df41d2fd42fe8973901642af7374a607_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 8.2MB
- Sample260801-s3fa4scg89
- SHA256 7f987d74e7618f540351d496a0f5e8babefb0791572fc93f2673e9e1193d2b5a
Malware Config
Extracted
-
vidar
-
2.3
-
9cb25cb773ed737a83cc951a8d9be848
-
https://45.83.180.74
-
https://telegram.me/af97ri
-
https://steamcommunity.com/profiles/76561198680197300
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Windows executables referencing non-Windows User-Agents 62 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 6 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 6 IoCs
- Executes dropped EXE 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_df41d2fd42fe8973901642af7374a607_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_df41d2fd42fe8973901642af7374a607_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FkdCl.exe"C:\Users\Admin\AppData\Local\Temp\FkdCl.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\zfNtb.exe"C:\Users\Admin\AppData\Local\Temp\zfNtb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\zfNtb.exeC:\Users\Admin\AppData\Local\Temp\zfNtb.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FkdCl.exe
zfNtb.exe
memory/3548-11-0x0000000140000000-0x0000000140508000-memory.dmp
memory/3548-10-0x0000000140000000-0x0000000140508000-memory.dmp
memory/3548-9-0x0000000140000000-0x0000000140508000-memory.dmp
memory/3548-8-0x0000000140000000-0x0000000140508000-memory.dmp
memory/3548-21-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-22-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-23-0x0000000140000000-0x0000000140508000-memory.dmp
memory/3548-24-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-25-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-26-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-27-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-28-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-29-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-30-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-31-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-32-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-33-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-34-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-35-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-36-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-37-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-38-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-39-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-40-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-41-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-42-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-43-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-44-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-46-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-45-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-47-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-48-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-49-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-50-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-51-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-52-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-53-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-54-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-55-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-56-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-57-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-58-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-59-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-60-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-61-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-62-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-63-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-64-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-65-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-66-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-67-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-68-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-69-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-70-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-71-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-72-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-73-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-74-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-75-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-76-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-77-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-78-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-79-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-80-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-81-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-82-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-83-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3548-84-0x00000001A0000000-0x00000001A0226000-memory.dmp