vidar | ddb8dccc4766f9beae8acd4b4c76438dc4d50cd138b861ef095208786a7d7334

General

Target
2026-08-23_957bfaf0576072165907b80996933e12_amadey_elex_luca-stealer_lynx_njrat_redline-stealer
Size 2.7MB
Sample260824-ff8b6acb42
SHA256 ddb8dccc4766f9beae8acd4b4c76438dc4d50cd138b861ef095208786a7d7334
MD5 957bfaf0576072165907b80996933e12
SHA1 070abbc3afdb6e8fda7e999dfd993dd0ef2cd20d
SHA512 0e4a4ab1ad202beef95d589388d9158fe832a4aea0662151a50eeee1242494e73e45a4e24a37c6ee022b748a7aa378c5f5873f62583e47ac776e6a4a9c95586a
SSDEEP 49152:FGtEqC1KGcn9Ji4d3aqtycCoBH8ywJSc3qIxoCJBNHnRF0vgzxNegH+m7F2ibLl:FGtEqhGS7i4d3ancCoZ8ywJSc3qIxoCz
TLSH
T104D5BE739301C36ED793703A80CF9D3536095671662F7CC36705AAA8DA172EE1628FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

52.1

Botnet

1325

C2

https://t.me/verstappenf1r
https://climatejustice.social/@ronxik312

Attributes

profile_id
1325

Targets

- Target
  2026-08-23_957bfaf0576072165907b80996933e12_amadey_elex_luca-stealer_lynx_njrat_redline-stealer
- Size 2.7MB
- SHA256 ddb8dccc4766f9beae8acd4b4c76438dc4d50cd138b861ef095208786a7d7334
- MD5 957bfaf0576072165907b80996933e12
- SHA1 070abbc3afdb6e8fda7e999dfd993dd0ef2cd20d
- SHA512 0e4a4ab1ad202beef95d589388d9158fe832a4aea0662151a50eeee1242494e73e45a4e24a37c6ee022b748a7aa378c5f5873f62583e47ac776e6a4a9c95586a
- SSDEEP 49152:FGtEqC1KGcn9Ji4d3aqtycCoBH8ywJSc3qIxoCJBNHnRF0vgzxNegH+m7F2ibLl:FGtEqhGS7i4d3ancCoZ8ywJSc3qIxoCz
- TLSH
  T104D5BE739301C36ED793703A80CF9D3536095671662F7CC36705AAA8DA172EE1628FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

1325 discovery vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing potential Windows Defender anti-emulation checks
- Vidar Stealer
  stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing potential Windows Defender anti-emulation checks

Vidar Stealer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2