Overview

overview

10

Static

static

3

TradingVie...ed.exe

windows10-2004-x64

10

TradingVie...ed.exe

windows10-ltsc_2021-x64

10

Resubmissions

12/08/2026, 06:32

260812-ha293abq2s10

12/08/2026, 06:19

260812-g29msazhpa7

Sharing

Copy URL Twitter E-mail

General

  • Target
    TradingView Premium Desktop_patched.exe
  • Size 3.6MB
  • Sample260812-ha293abq2s
  • SHA256 a31d36bc01708fdd740b54f82a8c5ab7caa3b599e7ad0e6d63d6caccd98c6103
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vidare019f45af86d9aeaf5946f339ddc7bd3defense_evasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • vidar

Version

  • 18.4

Botnet

  • e019f45af86d9aeaf5946f339ddc7bd3

C2

  • https://telegram.me/k33dro

  • https://steamcommunity.com/profiles/76561198732393960

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Targets

    • Target
      TradingView Premium Desktop_patched.exe
    • Size 3.6MB
    • SHA256 a31d36bc01708fdd740b54f82a8c5ab7caa3b599e7ad0e6d63d6caccd98c6103
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    e019f45af86d9aeaf5946f339ddc7bd3defense_evasionexecutionvidarpersistencespywarestealertrojan

    • Detects Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks