vidar | b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
Size 11.8MB
Sample261007-b9ymlazzcy
SHA256 b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76
MD5 b2d8a7fa418143a4542b28c53e86a080
SHA1 d60a47075c410509c0bc77eab2ea58dc759487e6
SHA512 042229efddbbf5225c4b0e30aaf3b0357a0cdb01e31cb663be8120b473afc1bd9164c6f43bb8364ceea976d8314497b620c18ba13284f6f944e68428d31971e7
SSDEEP 49152:S01Zdh9X2Qlb2jVPz8Jw7lzDY8ClWug9WDTYJcfgAwZvRJbbz:TPCYtG
TLSH
T1CDC60947728800ECC98BD77544B15E7A12F23DEE5122BB4A0F997EA02F177956F68F08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

18639d8e3c129270e4d9f4328b3819a1 discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

18639d8e3c129270e4d9f4328b3819a1

https://telegram.me/bj00tyr
https://steamcommunity.com/profiles/76561198630398488

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
4848	b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe

C:\Users\Admin\AppData\Local\Temp\b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe
"C:\Users\Admin\AppData\Local\Temp\b106a8b8ffa1c67e0e8f21a2015d0f0935e16e9e710c95b1bef3f924d532bd76.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-0-0x0000000390000000-0x0000000390294000-memory.dmp

Download

memory/4848-1-0x0000000390000000-0x0000000390294000-memory.dmp

Download

memory/4848-2-0x0000000390000000-0x0000000390294000-memory.dmp

Download