vidar | eabb2f233c99b926ed981283ef57ed8b6157807155ff446fd4accf3754d977fe

General

Target
2026-08-23_a8698ddcbed71716b1a72551ec7a8ed5_amadey_elex_luca-stealer_lynx_njrat_redline-stealer
Size 2.7MB
Sample260824-crbwjscl3w
SHA256 eabb2f233c99b926ed981283ef57ed8b6157807155ff446fd4accf3754d977fe
MD5 a8698ddcbed71716b1a72551ec7a8ed5
SHA1 fe6e1982a7bf869c1115a28311b608b0cf81ac54
SHA512 f58071ea191592ad0a6a77129da3250b626eb38253c566c65b0f746e4e8eedeab2c4df1a23b549b38dde19222a3e7f54fc7a916af83e82cbaa0a7aabce12b05c
SSDEEP 49152:yWmAmLnNBbC/8XaCqvir2fRvZXtX0DRWLY6jpInU+5f71IMlwf0lK/rw3ljGPmfr:yWXUBw8qCqar2fRvZXtX0DRuYepInU+3
TLSH
T1D4D5BF739301C36AE753703A80CF9D2636095271662F7CC3A7055BA8DB172EE5628FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

52.1

Botnet

1347

C2

https://t.me/verstappenf1r
https://climatejustice.social/@ronxik312

Attributes

profile_id
1347

Targets

- Target
  2026-08-23_a8698ddcbed71716b1a72551ec7a8ed5_amadey_elex_luca-stealer_lynx_njrat_redline-stealer
- Size 2.7MB
- SHA256 eabb2f233c99b926ed981283ef57ed8b6157807155ff446fd4accf3754d977fe
- MD5 a8698ddcbed71716b1a72551ec7a8ed5
- SHA1 fe6e1982a7bf869c1115a28311b608b0cf81ac54
- SHA512 f58071ea191592ad0a6a77129da3250b626eb38253c566c65b0f746e4e8eedeab2c4df1a23b549b38dde19222a3e7f54fc7a916af83e82cbaa0a7aabce12b05c
- SSDEEP 49152:yWmAmLnNBbC/8XaCqvir2fRvZXtX0DRWLY6jpInU+5f71IMlwf0lK/rw3ljGPmfr:yWXUBw8qCqar2fRvZXtX0DRuYepInU+3
- TLSH
  T1D4D5BF739301C36AE753703A80CF9D2636095271662F7CC3A7055BA8DB172EE5628FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

1347 discovery vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing potential Windows Defender anti-emulation checks
- Vidar Stealer
  stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing potential Windows Defender anti-emulation checks

Vidar Stealer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2