vidar | 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 2.2MB
Sample261107-c74w9sty4m
SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
MD5 fcfda692c84f930191c2b8b1adbcddb9
SHA1 cda8edd09090da67fc542a4f839135fc156363f0
SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
TLSH
T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ef045f18455132bc2e22c24a3c41c8a9 defense_evasion discovery vidar spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

Botnet

ef045f18455132bc2e22c24a3c41c8a9

https://168.222.97.79
https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral10/memory/4100-2-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral10/memory/4100-41-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4100	rundll32.exe
9	4100	rundll32.exe
10	4100	rundll32.exe
11	4100	rundll32.exe
12	4100	rundll32.exe
13	4100	rundll32.exe
14	4100	rundll32.exe
15	4100	rundll32.exe
16	4100	rundll32.exe
17	4100	rundll32.exe
18	4100	rundll32.exe
19	4100	rundll32.exe
20	4100	rundll32.exe
21	4100	rundll32.exe
23	4100	rundll32.exe
24	4100	rundll32.exe
25	4100	rundll32.exe
26	4100	rundll32.exe
27	4100	rundll32.exe
28	4100	rundll32.exe
29	4100	rundll32.exe
30	4100	rundll32.exe
31	4100	rundll32.exe
32	4100	rundll32.exe
33	4100	rundll32.exe
34	4100	rundll32.exe
35	4100	rundll32.exe
36	4100	rundll32.exe
37	4100	rundll32.exe
38	4100	rundll32.exe
39	4100	rundll32.exe
40	4100	rundll32.exe
41	4100	rundll32.exe
42	4100	rundll32.exe
44	4100	rundll32.exe
47	4100	rundll32.exe
48	4100	rundll32.exe
49	4100	rundll32.exe
50	4100	rundll32.exe
51	4100	rundll32.exe
52	4100	rundll32.exe
53	4100	rundll32.exe
54	4100	rundll32.exe
55	4100	rundll32.exe
56	4100	rundll32.exe
57	4100	rundll32.exe
58	4100	rundll32.exe
59	4100	rundll32.exe
60	4100	rundll32.exe
61	4100	rundll32.exe
62	4100	rundll32.exe
63	4100	rundll32.exe
64	4100	rundll32.exe
65	4100	rundll32.exe
66	4100	rundll32.exe
67	4100	rundll32.exe
68	4100	rundll32.exe
69	4100	rundll32.exe
70	4100	rundll32.exe
71	4100	rundll32.exe
72	4100	rundll32.exe
73	4100	rundll32.exe
74	4100	rundll32.exe
75	4100	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-0-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4100-2-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4100-41-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4100-40-0x00007FFC6D5A0000-0x00007FFC6D7FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads