vidar | 59e0c31f31dc2156dc6e27adab84347fe75a29ac2d2f1660b2d609c71f27ac5a

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 88.0MB
Sample261017-mx84caes5v
SHA256 59e0c31f31dc2156dc6e27adab84347fe75a29ac2d2f1660b2d609c71f27ac5a
MD5 9de124874e1326ed36897a3815f02803
SHA1 fae9e5b28613892832b9ba3207347abb307d2771
SHA512 d0002650d3f28647da6f1b8709da78ba6bd0bee73b031f854492f87c247924b1cb4b6cf7bf62db0cdde501fa5bf50a62016dd80006404724dda9a6f8a0f024f2
SSDEEP 1572864:RKhcD38oThMkmn7DQneNrNehCLuoocVoKLOdWAhinH8CMf34Q7KWURwAEetHL:RKU8odMkK70ngNU+uoocVo1dVG8Cev+f
TLSH
T190183303BD6185A9C4EAF3348AAB5212B7797C8C1B7667D72F14F6782E367C04A76304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

d813994ce1dbd4db71c3b48d6cf58bfc discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

d813994ce1dbd4db71c3b48d6cf58bfc

https://172.237.117.11
https://t.me/scii0n
https://steamcommunity.com/profiles/76561198622044578

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5500	2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_9de124874e1326ed36897a3815f02803_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5500-0-0x0000000170000000-0x000000017028E000-memory.dmp

Download

memory/5500-1-0x0000000170000000-0x000000017028E000-memory.dmp

Download

memory/5500-2-0x0000000170000000-0x000000017028E000-memory.dmp

Download

memory/5500-3-0x0000000170000000-0x000000017028E000-memory.dmp

Download

memory/5500-4-0x0000000170000000-0x000000017028E000-memory.dmp

Download