vidar | 02c8728df8b2321406ac75f52acd042f09ae5fe462c09b4837fb63d8d70f147a

General

Target
2026-11-05_83f781a61775e9cf2f714dc65577972c_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 87.9MB
Sample261106-wjvs8sev9m
SHA256 02c8728df8b2321406ac75f52acd042f09ae5fe462c09b4837fb63d8d70f147a
MD5 83f781a61775e9cf2f714dc65577972c
SHA1 317dda2964a49ba7c163e27ad4a1ee9062d690a8
SHA512 b33b692249f6de50de20ab23c84bb5ca3e2df18df0eaf2f5f6a4c18f82ea867311162ba65061a63a3647d0dd3adc9c2bdb570a98842d36cc61e153284c05a909
SSDEEP 1572864:NVKjRPT+WWlrKu9bf+WUNopAIogpu+Qk42sk4CpinghUPsg03rwUSbMrU6c:NYjRPT+WeGu9qQLpuhB2sTe0f+3rwU0F
TLSH
T13718330B9C9166AAE897E37CE4AB1442B7B97C40BB3136D32E407DB42D733D469B8705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

4.1

Botnet

24363f2788e69f30ea360d7df52b3192

C2

https://2.29.157.217
https://telegram.me/eg0ttt
https://steamcommunity.com/profiles/76561198612847216
https://2.29.157.217/gate
https://b.akuntoti.net/gate

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Targets

- Target
  2026-11-05_83f781a61775e9cf2f714dc65577972c_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 87.9MB
- SHA256 02c8728df8b2321406ac75f52acd042f09ae5fe462c09b4837fb63d8d70f147a
- MD5 83f781a61775e9cf2f714dc65577972c
- SHA1 317dda2964a49ba7c163e27ad4a1ee9062d690a8
- SHA512 b33b692249f6de50de20ab23c84bb5ca3e2df18df0eaf2f5f6a4c18f82ea867311162ba65061a63a3647d0dd3adc9c2bdb570a98842d36cc61e153284c05a909
- SSDEEP 1572864:NVKjRPT+WWlrKu9bf+WUNopAIogpu+Qk42sk4CpinghUPsg03rwUSbMrU6c:NYjRPT+WeGu9qQLpuhB2sTe0f+3rwU0F
- TLSH
  T13718330B9C9166AAE897E37CE4AB1442B7B97C40BB3136D32E407DB42D733D469B8705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

24363f2788e69f30ea360d7df52b3192 defense_evasion discovery vidar stealer
- Detects Vidar Stealer v4.0 and higher memory dump
  stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Custom signature
  
  Detects Windows executables referencing non-Windows User-Agents
- Custom signature
  
  Detects executables referencing combination of virtualization drivers
- Custom signature
  
  Detects executables referencing many IR and analysis tools
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2