vidar | 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 2.2MB
Sample261107-c8d28sty4n
SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
MD5 fcfda692c84f930191c2b8b1adbcddb9
SHA1 cda8edd09090da67fc542a4f839135fc156363f0
SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
TLSH
T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ef045f18455132bc2e22c24a3c41c8a9 defense_evasion discovery vidar spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

Botnet

ef045f18455132bc2e22c24a3c41c8a9

https://168.222.97.79
https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral9/memory/4636-1-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral9/memory/4636-41-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	4636	rundll32.exe
12	4636	rundll32.exe
14	4636	rundll32.exe
15	4636	rundll32.exe
16	4636	rundll32.exe
18	4636	rundll32.exe
20	4636	rundll32.exe
21	4636	rundll32.exe
23	4636	rundll32.exe
25	4636	rundll32.exe
27	4636	rundll32.exe
31	4636	rundll32.exe
33	4636	rundll32.exe
38	4636	rundll32.exe
39	4636	rundll32.exe
40	4636	rundll32.exe
41	4636	rundll32.exe
42	4636	rundll32.exe
44	4636	rundll32.exe
52	4636	rundll32.exe
58	4636	rundll32.exe
59	4636	rundll32.exe
60	4636	rundll32.exe
62	4636	rundll32.exe
63	4636	rundll32.exe
64	4636	rundll32.exe
65	4636	rundll32.exe
67	4636	rundll32.exe
68	4636	rundll32.exe
69	4636	rundll32.exe
70	4636	rundll32.exe
71	4636	rundll32.exe
72	4636	rundll32.exe
76	4636	rundll32.exe
80	4636	rundll32.exe
81	4636	rundll32.exe
82	4636	rundll32.exe
83	4636	rundll32.exe
85	4636	rundll32.exe
86	4636	rundll32.exe
87	4636	rundll32.exe
88	4636	rundll32.exe
89	4636	rundll32.exe
91	4636	rundll32.exe
92	4636	rundll32.exe
93	4636	rundll32.exe
94	4636	rundll32.exe
95	4636	rundll32.exe
96	4636	rundll32.exe
97	4636	rundll32.exe
98	4636	rundll32.exe
99	4636	rundll32.exe
100	4636	rundll32.exe
102	4636	rundll32.exe
103	4636	rundll32.exe
104	4636	rundll32.exe
105	4636	rundll32.exe
106	4636	rundll32.exe
108	4636	rundll32.exe
109	4636	rundll32.exe
110	4636	rundll32.exe
111	4636	rundll32.exe
112	4636	rundll32.exe
114	4636	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-0-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4636-1-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4636-41-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4636-40-0x00007FF9350F0000-0x00007FF93534E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads