vidar | 04c9688d45188ee977bb3ab1073802ef3b3b19fb5176d0d302eb1aa6116ef2b0

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sеt_Uр [UРD].exe
Size 12.8MB
Sample261001-2dspkssamg
SHA256 04c9688d45188ee977bb3ab1073802ef3b3b19fb5176d0d302eb1aa6116ef2b0
MD5 021efe07b3ec63b6de74d20ebcc42497
SHA1 283a838f520f5ac048ca08190f36bf612f7ef274
SHA512 750670231f8667a60ecb601b45fe03e8423833ff7c2709e1ea1a3f0427894a39bc4b341cce29d8212523845d177e98091385b8f7ab51bfd4874d584ab6270a06
SSDEEP 49152:vAcnedAN+E+0DSTLoibJk6drXSg+d3p7PdLK37Xqu8k+Q2cW/f2eVQ1fLMpZ+HN3:+Y4zx
TLSH
T1A9D60B07B24510ECC68BD37084F46A6A26F23DAE5632775A0F996FA02F167917FE4F04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

8751e599f4fbb2a2ceef597e53ab2bea discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

8751e599f4fbb2a2ceef597e53ab2bea

https://188.34.166.234
https://t.me/j88hor
https://steamcommunity.com/profiles/76561198633950250

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Sеt_Uр [UРD].exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Sеt_Uр [UРD].exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5096	Sеt_Uр [UРD].exe
5096	Sеt_Uр [UРD].exe
5096	Sеt_Uр [UРD].exe
5096	Sеt_Uр [UРD].exe
5096	Sеt_Uр [UРD].exe
5096	Sеt_Uр [UРD].exe

C:\Users\Admin\AppData\Local\Temp\Sеt_Uр [UРD].exe
"C:\Users\Admin\AppData\Local\Temp\Sеt_Uр [UРD].exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-1-0x00000005B0000000-0x00000005B0298000-memory.dmp

Download

memory/5096-0-0x00000005B0000000-0x00000005B0298000-memory.dmp

Download

memory/5096-4-0x00000005B0000000-0x00000005B0298000-memory.dmp

Download