Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 21:15
General
- Target 2026-09-03_d1a8b19d8eabac6ee745b837747f9c02_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 99.7MB
- Sample260905-z4cd6ssgrc
- SHA256 8209ba55fba69a2f7de4657af9ebea2ce3500ba9510fcacf67a05b74c8a5ecad
Malware Config
Extracted
-
vidar
-
3.2
-
4e497d09d1dc0c0a364ee7b2b6897d80
-
https://62.238.126.31
-
https://telegram.me/nag0e
-
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63727183
-
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=XmE5L
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Windows executables referencing non-Windows User-Agents 7 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_d1a8b19d8eabac6ee745b837747f9c02_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_d1a8b19d8eabac6ee745b837747f9c02_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4040-0-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-1-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-2-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-3-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-4-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-5-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-6-0x0000000490000000-0x0000000490295000-memory.dmp
memory/4040-7-0x0000000490000000-0x0000000490295000-memory.dmp