vidar | 7aa72f371bf6a807e7e6c1cd6dfa9131ddc714ce30f6c1ebd36e07f80d2a5707

General

Target
2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop
Size 698KB
Sample260930-m7myvsdf85
SHA256 7aa72f371bf6a807e7e6c1cd6dfa9131ddc714ce30f6c1ebd36e07f80d2a5707
MD5 5e81b47aff27985e4207f97490ae513e
SHA1 8a215ffa7260c483ab2d7050880bbb66f150a599
SHA512 3787d2bfa087c5e3d4ee6a08ce9fd3458a99da08c731f08d4310525a3bc11ab8a6a1ddd84335af6fbdf14b361d7b8eafc4e4a897009a56f83490edc303c48ee9
SSDEEP 12288:XZ5xzr3CrLPFYBhvhAfI3TV2c3ZwfuCc7x817REAbJBTyAt8V8oqhKB:Xtz+rR0hvefyV2mZwH31REAnyC8U
TLSH
T1D5E4F120A6A1C835E7F712F4596993A8EB3E3DB05B6450CB22D637EE36346E49D30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

40.8

Botnet

865

C2

https://pavlovoler.tumblr.com/

Attributes

profile_id
865

Targets

- Target
  2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 698KB
- SHA256 7aa72f371bf6a807e7e6c1cd6dfa9131ddc714ce30f6c1ebd36e07f80d2a5707
- MD5 5e81b47aff27985e4207f97490ae513e
- SHA1 8a215ffa7260c483ab2d7050880bbb66f150a599
- SHA512 3787d2bfa087c5e3d4ee6a08ce9fd3458a99da08c731f08d4310525a3bc11ab8a6a1ddd84335af6fbdf14b361d7b8eafc4e4a897009a56f83490edc303c48ee9
- SSDEEP 12288:XZ5xzr3CrLPFYBhvhAfI3TV2c3ZwfuCc7x817REAbJBTyAt8V8oqhKB:Xtz+rR0hvefyV2mZwH31REAnyC8U
- TLSH
  T1D5E4F120A6A1C835E7F712F4596993A8EB3E3DB05B6450CB22D637EE36346E49D30347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

865 discovery vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing potential Windows Defender anti-emulation checks
- Vidar Stealer
  stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing potential Windows Defender anti-emulation checks

Vidar Stealer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2