vidar | 22daed670d7371da5629b023d221ce08f8dcadc124bb72261488a3d2f7b37599

General

Target
2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 592KB
Sample261001-ls51fsvale
SHA256 22daed670d7371da5629b023d221ce08f8dcadc124bb72261488a3d2f7b37599
MD5 968b847c6a2bbcb336a8c534b5d1a43a
SHA1 c825d1fc6f9a204f33cc384298dda17c648314f9
SHA512 ef2f905f6eab18956349f36865b003e1438eb4925a17b21c7b01b030e6c2299ddba5cef7a5c7b8e773de892e08612a008196a49abedb5c05a793d0348081ece7
SSDEEP 12288:gM69CWgmtw+y0DAx8tE2eeRgEMRzjSSVVOlK8T0VCIKDM:gM60Hm6xxxSEreRgjNSvKFAIn
TLSH
T1CFD4130C3C81E437C0AA0872CC49D9C4EB59BDE1FA59DE872756273D8AF36A45B13287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41

Botnet

1008

C2

https://mas.to/@killern0

Attributes

profile_id
1008

Targets

- Target
  2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 592KB
- SHA256 22daed670d7371da5629b023d221ce08f8dcadc124bb72261488a3d2f7b37599
- MD5 968b847c6a2bbcb336a8c534b5d1a43a
- SHA1 c825d1fc6f9a204f33cc384298dda17c648314f9
- SHA512 ef2f905f6eab18956349f36865b003e1438eb4925a17b21c7b01b030e6c2299ddba5cef7a5c7b8e773de892e08612a008196a49abedb5c05a793d0348081ece7
- SSDEEP 12288:gM69CWgmtw+y0DAx8tE2eeRgEMRzjSSVVOlK8T0VCIKDM:gM60Hm6xxxSEreRgjNSvKFAIn
- TLSH
  T1CFD4130C3C81E437C0AA0872CC49D9C4EB59BDE1FA59DE872756273D8AF36A45B13287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

1008 discovery vidar stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing potential Windows Defender anti-emulation checks
- Vidar Stealer
  stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Vidar

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing potential Windows Defender anti-emulation checks

Vidar Stealer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2