vidar | 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
Size 11.5MB
Sample261007-cdfycabz2r
SHA256 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9
MD5 1daec83a0a8e7909926a47f945058b89
SHA1 45f3ab20cc78e6da974703f7bf65dee8493b39df
SHA512 77735be12b6b80cc35b0ed2fcf7f1648927d16479c61e9ff5ef5d196678ea5697ae16f0d204d7caa5d7273e1c6adc8e9dcfb3b0c8a6be3b5aae3c6967c8ee967
SSDEEP 49152:CVOMyojiJnqvmNdUXJb4Mdhs2loH1+y6YjyztOMnoC6KW+BQs6/WTqj:zoObVYtN7PFTqj
TLSH
T1A8C6E757338810ECCA8BDA7144B0597922B13DAE50327B6E0EE5BE902F1B7556F6CF09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

b98dd86b169ec45dd28e99dcad12402a discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

b98dd86b169ec45dd28e99dcad12402a

https://telegram.me/bj00tyr
https://steamcommunity.com/profiles/76561198630398488

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
4844	7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe

C:\Users\Admin\AppData\Local\Temp\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe
"C:\Users\Admin\AppData\Local\Temp\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000390000000-0x0000000390294000-memory.dmp

Download

memory/4844-1-0x0000000390000000-0x0000000390294000-memory.dmp

Download

memory/4844-2-0x0000000390000000-0x0000000390294000-memory.dmp

Download