Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 03:16
General
- Target 2026-08-05_22d2c064691f5ed6626c9103ffcd2df9_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 3.3MB
- Sample260805-dsrttsal4z
- SHA256 768e030b01d56dc6de54461f40ed15707cbba3f98da4efae55a13fca203462de
Malware Config
Extracted
-
vidar
-
2.3
-
9df9162ec766659114c10b95b81ffd6a
-
https://5.75.212.195
-
https://telegram.me/af97ri
-
https://steamcommunity.com/profiles/76561198680197300
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_22d2c064691f5ed6626c9103ffcd2df9_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_22d2c064691f5ed6626c9103ffcd2df9_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5256-0-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-1-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-2-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-3-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-4-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-5-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-6-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-7-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-8-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-9-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-10-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-11-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-12-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-13-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-14-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-15-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-16-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-17-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-18-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-19-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-20-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-21-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-22-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-23-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-24-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-25-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-26-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-27-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-28-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-29-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-30-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-31-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-32-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-33-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-34-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-35-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-36-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-37-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-38-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-39-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-40-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-41-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-42-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-43-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-44-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-45-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-46-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-47-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-48-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-49-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-50-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-51-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-55-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-54-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-53-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-52-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-56-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-57-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-58-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-59-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-60-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-61-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-62-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-63-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-64-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/5256-65-0x00000001A0000000-0x00000001A0226000-memory.dmp