Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/09/2026, 18:23
General
- Target jaffacakes118_8b75b786c5532e84aa175568b6bfc291cba37f7ed20a5a6375fd71dc5481b942.exe
- Size 2.2MB
- Sample260911-w1pcsasvhw
- SHA256 8b75b786c5532e84aa175568b6bfc291cba37f7ed20a5a6375fd71dc5481b942
Malware Config
Extracted
-
vidar
-
15.6
-
9cd495d1b147b830ef74ead7cbf4431dn
-
rif0lm
-
https://telegram.me/rif0lm
-
https://steamcommunity.com/profiles/76561198783900411
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Vidar Stealer 15 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8b75b786c5532e84aa175568b6bfc291cba37f7ed20a5a6375fd71dc5481b942.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8b75b786c5532e84aa175568b6bfc291cba37f7ed20a5a6375fd71dc5481b942.exe"1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-0-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-1-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-2-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-15-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-16-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-22-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-23-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-24-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-25-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-26-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-27-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-28-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-29-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-30-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-31-0x0000000140000000-0x0000000140631000-memory.dmp
memory/2940-32-0x0000000140000000-0x0000000140631000-memory.dmp