vidar | e0f43e3074c9f695190c457dd978d6b703b35256d2562c164f32e5559bfeed1d | Triage™

Login
Reports

Overview

overview

Static

static

5

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

LuaPackage...ode.js

windows10-2004-x64

3

LuaPackage...ode.js

windows11-ltsc_2024-x64

3

MpDlpService.exe

windows10-2004-x64

mpclient.dll

windows10-2004-x64

mpclient.dll

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Roblox-Client-Tracker.zip
Size 3.5MB
Sample260810-g5gfeaxwev
SHA256 e0f43e3074c9f695190c457dd978d6b703b35256d2562c164f32e5559bfeed1d
MD5 80fcd518e84ae7b9334785e62569b3c4
SHA1 25343eb0395c83068602151b2bf1fc8345655773
SHA512 6cd6d0191afb45b922605635152e69c2940e97fa5bc82aabfb42ba2cb0a3157a672d10d0c0827cc767be39725e6117f1d3224c18654a0c88e09e956e2f956ec7
SSDEEP 49152:llezEKiv/eyQVQi2uMaU5pF7yzBfD6WMxTBM8UfYC2H2dSHhigix:llS67WQi26cp5yzBL6TxTBLUAlavB
TLSH
T1B60633E4E233EA83EE98007EB3766D622D5C72BE0818A306367395D44C49735159F9BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vidar c948db7ccfb97f2f0bfa248274085e2d execution stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Accordion/Accordion.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Accordion/Accordion.code.js

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Button/Button.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Button/Button.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/ButtonGroup/ButtonGroup.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/ButtonGroup/ButtonGroup.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Checkbox/Checkbox.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Checkbox/Checkbox.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Chip/Chip.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Chip/Chip.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Coachmark/Coachmark.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Coachmark/Coachmark.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/ColorPicker/ColorPicker.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/ColorPicker/ColorPicker.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dialog/Dialog.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dialog/Dialog.code.js

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dropdown/Dropdown.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dropdown/Dropdown.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/EducationalTooltip/EducationalTooltip.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/EducationalTooltip/EducationalTooltip.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/FeedbackAlert/FeedbackAlert.code.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

LuaPackages/Packages/_Index/Foundation/Foundation/Components/FeedbackAlert/FeedbackAlert.code.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

MpDlpService.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

c948db7ccfb97f2f0bfa248274085e2d vidar stealer

Behavioral task

behavioral24

Sample

mpclient.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

c948db7ccfb97f2f0bfa248274085e2d vidar stealer

Behavioral task

behavioral25

Sample

mpclient.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

c948db7ccfb97f2f0bfa248274085e2d vidar stealer

Malware Config

Extracted

Family

vidar

Version

2.1

Botnet

c948db7ccfb97f2f0bfa248274085e2d

C2

https://set.turbo88galaxy.top
https://telegram.me/turb00m
https://steamcommunity.com/profiles/76561198689449626

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0

Targets

- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Accordion/Accordion.code.md
- Size 3KB
- SHA256 6f80874467afe6da311dca78e0a783af4cb500501e4dd4c591328a698260421b
- MD5 a1987ac95496d1b2932b9235d616eb23
- SHA1 c161da62eb57e5fd422d22ff6e252eef984ba788
- SHA512 1b6f46e5ac4f42d4f8d606259cf71c94d97feeec170e46bd63e699b688f96fa6c0d9e169ba8d09d63e7ae3e6e330dbf69ac0910a2779398251ab7443fa9b87f7
- TLSH
  T1CF710E3520550264125BF0AFAFBE6D1EBE182007B6993D64349C849C3FBC11F96F87AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Button/Button.code.md
- Size 1KB
- SHA256 48090de2de85a9a40f25795c1acf83411d3802a78bf3d5763245d9316672aa7e
- MD5 218189005df802c6b30ca60fe6623c21
- SHA1 670f78261e6605dfd8ea14d462d8447c67dff010
- SHA512 834a7870e13db47cabbf753ad8f12bf15c78fd2487d7c1145740a5f078afde236a96fa8ad3a1ef7486558f1d763f38ca8f2648e5f789fbfb184439a89d7211e5
- TLSH
  T14631E2BB32456328D7311022F56F71C4AB019BB43775FC74508D416C22F99AA41FA6DB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/ButtonGroup/ButtonGroup.code.md
- Size 3KB
- SHA256 917550d6aae6f564d11950be44bcd21e72d17a9c4d89afef321ed22690183514
- MD5 9ac24e20d98af714ae1578b8bf1a41e1
- SHA1 2c399e21dc6b35264080e534e6ba175b1b37f6b5
- SHA512 11d97063406660eb00cb9eadaa1264fcc881c469dd08db2df13f9fcdbe5e5242c5713558b307a89bb92c478197ebdf3f94c72fe298339a126a6a82771655dfe4
- TLSH
  T18D61CDFDB0A1358CAA2330B7D46B2016BA2592E76F557C10720E63991F9C40D92FA75F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Checkbox/Checkbox.code.md
- Size 737B
- SHA256 5440cf5b578719c8467e9fb70ccff65d9c1a8643bf4728e71c3c5b88b6af2c17
- MD5 4b8e624d85efd8aa981bc2bd442f1585
- SHA1 8cb69ef69e9c548baeaef038bcb452b833c29918
- SHA512 ed32d3c481560ca32afdc11ae4fe19428e1821b704c7782eb800a2acc4305caaab6650c05874b745e4ea9c48fa1962fb2cd40dca2d62d0a5286fd83ddbe8ff7f
- TLSH
  T16101DC3B385933AD3B320183E56E09A76E3489D021A552B482C2D81C60EEEAC42EF75C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Chip/Chip.code.md
- Size 1KB
- SHA256 07d90836708e09c7fb6a5588aee6991687c3db5b720b2b4fb47eb729a23e328e
- MD5 b2708b4e48dcffd1ad62eceb47fc62b5
- SHA1 2b716843da3c01921c349cb6f9a6d719b0e6e2aa
- SHA512 0ac5cc43999caa4dad6c70e3a6bbeb2a2bdacbee47bb7d5d84b101663910bc72cad487e7fdf5eec26fd895ea77abd9f794cad39cde3dc7c6bd9ce2a1c776945a
- TLSH
  T13721121E31DF50C4E6171097B1F56353781461852F98A870F48CC0B92B1449E60FBFED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Coachmark/Coachmark.code.md
- Size 3KB
- SHA256 23cabe6d1e801e9a2bf454b6bb827ead7f7d422069577902c97309e71aaa699c
- MD5 b985e6634e51090faa8b0affb289a3ef
- SHA1 0091c015c644b4cdaed6e6033921ce791d14fbe4
- SHA512 a20fea8f80001d317db32c8917d17d564b92825032c32b01b8a65c7e05153b26be232f31afc479b2cb70db88e38f3545c453d40a99b301bc8f1f4506f59a46ec
- TLSH
  T1B681976BE11D139C4267205FE05F52E5BD3D526AF39130FBA089419D24ED44683EE987
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/ColorPicker/ColorPicker.code.md
- Size 2KB
- SHA256 2a334c7991befd9b0a3729f72cc310bcb554f1e84c6f8d6aa4889fcb7a637080
- MD5 f2d9b72504d9b456f12fbaf58ec7b8e0
- SHA1 56d072b148f71208ec4153a2383d6baa79b4dc0d
- SHA512 8ec49bf82af018154eaf8ae77b056ba62973e8590b501fbedbfeb7fe5ba08a26ef0a1b4623d4b7140d30a4c916141936ed8722aaa63310ff9fd950fd317851e0
- TLSH
  T1BC51973CF29636EF053F00FFB49718986D1B3A5451C805DE6622529C93D809FC2EB4AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dialog/Dialog.code.md
- Size 5KB
- SHA256 4ca59702a0a4057e22f93f2d3daf9b966765352506a69ee037174db06ddfe7ae
- MD5 6ee62de9cfbcb1975761c93781b9ab0f
- SHA1 1442c6e805d330604bc858d766a88733aff19d29
- SHA512 1aa082de7273417c27286bad63be147595f0383f889bd71d6c0f04d6fa784ae93c46b1f56057df81c6d10adee4eb909d59e081ffa6e6003ef9e4b782c96754d0
- SSDEEP 96:xfmHuGA1OS1V6ATWgenASXhuVFCKRKGSM+pt1w3hXC1dHww1VBMppHJjqIndL2KR:Bau/1OQpTWFnASETEM+pt1w3hXC1dQww
- TLSH
  T137C18769B14D22A48F97267B6A6F01C2F23C512123193974348E52EC2FFC82D62FB5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dropdown/Dropdown.code.md
- Size 836B
- SHA256 dc6be58ae86485196ac7d1165d9f7ea5b9d75db8e82c3de1e425e7025b0164c5
- MD5 871d247887d83fe8e65ea8f84462e3f4
- SHA1 3ecda026f6ba49fb38c17e7e02534741fcf3db89
- SHA512 d7b5db51deed7c6a6332b24a1688e9aeac4476dbc9f7d120823c3b7aca7168fef41082c3a01f55f16e5b47694aa7398432ddfd49269b56584a96c24e451dbd15
- TLSH
  T12D01EF38918977A1838B20935CBD30C6AA118215E486B6E1F14D42EC135662CE2F3DDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/EducationalTooltip/EducationalTooltip.code.md
- Size 4KB
- SHA256 532793a61ab81914e76b77a1b7d590e5baec301253ae2da5a5e0769b8151904e
- MD5 caf27ebafd42cc7f19aa03a1bf76a794
- SHA1 ed6a99c78bdb4f0586b03b54523b21e9d024a32f
- SHA512 437860af354fcaf3f27d1022f939f58f72ff707c9308930477f6aa9974e9bdc6e7e7ed13eab1908217f275235a43873463a28ae685412dff762d3f16b219c024
- SSDEEP 96:VrmHGK/SG/7ADuqRB0xSyGJ7MbjFziYRh8L+ZDsXixSxSs7MD:Vq/7A6qsfk7MbjliYT8LIDyiM17Q
- TLSH
  T1F48156ABE12A139C436B201FA0AF63E5793E516AE3D134FBD04981DC159D40683EBD8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/FeedbackAlert/FeedbackAlert.code.md
- Size 1KB
- SHA256 8b0ca28998673c0e0c76e54261b3d71d460e70392b6257e1391276969fb5affa
- MD5 dbf4815247ccc22cefcd42fa6a2980d5
- SHA1 d2c44d38cc8ac5df58b9c41685883018086f268b
- SHA512 f83210700e7a5eb3830280360338a3ad81f62c66d274e924e9bac532958bc0441ca607f338e3c82884c88ecad74c7a4f0bdc99cee8e88dde75dfda3ba86574cf
- TLSH
  T17431216AF20A2658279360E9D42F72912A3CD0A57DD17475A44F13DC11AD60CD3FB94B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  MpDlpService.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

c948db7ccfb97f2f0bfa248274085e2d vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23
- Target
  mpclient.dll
- Size 3.7MB
- SHA256 90c5ca87d0fe3fa240b01af3c85adafd9f90e841204cbb122c6a538a2dff6757
- MD5 790145cd39af7feeb893487af476e6dc
- SHA1 28b95a45c9a3b289d491f581e368280d85127565
- SHA512 779a14d610c53e6f866f4c574fb1d5c2a71043bbb0d271a83a543eeab04cb1a649c538e14c11274f2bfc0b993325548e6f7c5d2e979134cfb1cc49e9150f271c
- SSDEEP 49152:oN8L8xfIx7vcupLhK3LpHDgeTZ3UOu+ab6u7jlHH4ueac6IpIEd:oNj4Zhwdsj8JyEd
- TLSH
  T14F068D43EED098ABC499A33289B692417B3DBC491B3227D72D90B7772E777C06836714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

c948db7ccfb97f2f0bfa248274085e2d vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral24 behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

c948db7ccfb97f2f0bfa248274085e2dvidarstealer

behavioral24

c948db7ccfb97f2f0bfa248274085e2dvidarstealer

behavioral25

c948db7ccfb97f2f0bfa248274085e2dvidarstealer

© 2018-2026

Terms | Privacy