TL;DR

• VIDAR (Windows stealer) Capable of stealing various types of data using different methods, including browser data, credentials, cookies, cryptocurrency wallets, messengers, and local files. Uses polymorphic builds to evade signature-based detection and multi-threaded data exfiltration for faster execution. Targets browsers and decrypts data via Local State + CryptUnprotectData Uses anti-analysis techniques. Resolves dead-drop C2 via Telegram bots and Steam profiles.

• VENON (Windows banker RAT) Targets users of financial services and steals banking credentials via overlay attacks. Written in Rust and uses LNK hijacking + DLL side-loading for hidden execution and persistence. Tracks user activity and banking website interactions. Uses anti-analysis techniques including AMSI/ETW bypass and environment checks. Communicates with C2 to receive configuration and commands.

• SLOPOLY (Windows backdoor/C2 client) PowerShell-based client component discovered in the Hive0163 ransomware ecosystem. Based on its style, structure, and static configuration patterns, it’s likely generated or heavily assisted by an LLM. Maintains local persistence logging, sends periodic heartbeats, and polls C2 for commands. Shows persistence via a scheduled task named Runtime Broker

1) VIDAR (Windows)

Sample: ANY.RUN

VIDAR is a stealer capable of stealing various types of data using diverse methods. The malware targets browser data, credentials, cookies, crypto wallets, messengers, and local files. It uses polymorphic builds, multi-threaded exfiltration, and anti-analysis techniques to improve evasion and speed up collection.

How to detect: By monitoring abnormal network activities, requests and mutexes.

Key facts:

• VIDAR uses polymorphic builds to evade signature-based detection.
• It performs multi-threaded data exfiltration for faster execution.
• With browsers as a key target, it decrypts data via Local State + CryptUnprotectData.
• It uses Telegram bots and Steam profiles as dead-drop C2 resolvers.
• VIDAR steals credentials, cookies, crypto wallets, messengers, and local files.

Analytical notes:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion	VT First Submission
2026-03-19	acronis.com	2026-03-25	1	2026-03-19

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: syncObjectName:"ierojgoqwje_admin"

IOCs:

• SHA256: f62a203f236502ecade96a9c4acf9096a0e07e3c0e04323c43d4ef2af8570e60
• SHA256: 1099f6aeec4cb37e44c2bb719cf6e5e1b11f1410ea45c7dce388e32321a99aac
• SHA256: 335f9ce1bc02050e13f795a939e78b509be165a02dce7275bc7384e8ceb1406e
• SHA256: 635110b915d4460e3089a8c309d6346efe0133f003f33646b6044c4a41a98e6b
• SHA256: 163a5205b973dd5a139e04d14c720971c077f263a908d1201e6ea70ad1eb3085
• SHA256: fe4643a16c8302afcc484a7126846560fdf0eccea8ad2489b628b7f40cf614a4
• SHA256: 52b83a920f3500b33da6a5a9f3f8745ab53fd736c2a8c93f1299a3d64670d321
• SHA256: b45f7f84536ea00c8808e4246f473b02cd0110168199db174b720b5201408c4a

MITRE:

Technique ID	Technique Name	Evidence
T1480.002	Execution Guardrails: Mutual Exclusion	Uses execution guardrails to control execution.
T1082	System Information Discovery	Checks different system data.
T1012	Query Registry	Queries different registries.

2) VENON (Windows)

Sample: ANY.RUN

VENON is a banking RAT aimed at users of financial services. Its main purpose is stealing banking credentials through overlay attacks, tracking user activity, and intercepting interactions with banking websites. The malware is written in Rust, which makes it stand out from most banking trojans, and it uses an infection chain based on LNK hijacking and DLL side-loading for stealthy execution and persistence. Control is handled through a C2 channel that delivers configuration and commands.

How to detect: It can be detected by the presence of a malware-created artifact: C:\Users\admin\AppData\Roaming\hwid_sent.dat.

Key facts:

• VENON is written in Rust, which complicates analysis and signature-based detection.
• It uses LNK hijacking and DLL side-loading for execution and persistence.
• Banking data is intercepted via overlay attacks.
• It tracks active windows and targets banking applications.
• VENON applies anti-analysis techniques such as AMSI/ETW bypass and environment checks.

Analytical notes:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion	VT First Submission
2026-03-17	zenox.ai	2026-03-10	9	2026-03-04

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"C:\\Users\\admin\\AppData\\Roaming\\hwid_sent.dat"

IOCs:

• File: C:\Users\admin\AppData\Roaming\hwid_sent.dat
• SHA256: c482286a7fdfb64d308c197a4deabcd773b8b62d9e74d1d08fcfd02568d75d72
• Domain: brasilmotorsvs14.com

MITRE:

Technique ID	Technique Name	Evidence
T1547.009	Shortcut Modification	Uses LNK hijacking to start the malicious chain.
T1574.002	DLL Side-Loading	Loads a malicious DLL through legitimate applications.
T1055	Process Injection	Executes malicious code inside trusted processes.
T1056.002	Input Capture: GUI Input Capture	Uses overlay windows to steal banking data.
T1082	System Information Discovery	Collects system and user activity information.
T1562.001	Impair Defenses	Bypasses protection using AMSI/ETW bypass.
T1071.001	Web Protocols	Communicates with C2 over web protocols for configuration delivery.

3) SLOPOLY (Windows)

Sample: ANY.RUN

SLOPOLY is a PowerShell-based backdoor/C2 client discovered as part of the Hive0163 ransomware attack. It is characterized as a likely AI/LLM-powered malware component: the script includes extensive comments, logging, error handling, well-named variables, and static, constructor-style configuration such as the session ID, mutex name, C2 URL, and beacon intervals.

How to detect: Its detection is based on identifying specific artifacts of malware presence in the operating system: primarily, the presence of a log file matching the regular expression C:\Users\[^\\]+\\AppData\\Local\\Temp\\persistence\.log, especially when it contains the line Polymorphic C2 client started.

Key facts:

• Slopoly is a PowerShell client component in the new C2 platform.
• Based on its code style, including extensive comments, logging, error handling, and precisely named variables, the component itself is likely generated by an LLM.
• The developer added a timestamp and static values such as the session ID, mutex name, C2 URL, and beacon intervals, and the malware was deployed to C:\ProgramData\Microsoft\Windows\Runtime\.
• The script sends a JSON heartbeat to the C2 endpoint /api/commands every 30 seconds, polls for commands every 50 seconds, executes the received commands via cmd.exe, and maintains a detailed local persistence.log file, which gets overwritten when it reaches 1 MB.
• There are traces of persistence via a scheduled task called Runtime Broker.

Analytical notes:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion
2026-03-19	ibm.com	2026-03-25	2

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"C:\\Users\\admin\\AppData\\Local\\Temp\\persistence.log"

IOCs:

• SHA256: 0884e5590bdf3763f8529453fbd24ee46a3a460bba4c2da5b0141f5ec6a35675
• URL: plurfestivalgalaxy[.]com
• IP: 94.156.181[.]89

MITRE:

Technique ID	Technique Name	Evidence
T1059.001	Command and Scripting Interpreter: PowerShell	Slopoly is implemented as a PowerShell script executing commands received from C2.
T1053.005	Scheduled Task/Job: Scheduled Task	Persistence via scheduled task “Runtime Broker” reported.
T1071.001	Application Layer Protocol: Web Protocols	Periodic HTTP POST heartbeat and command polling to /api/commands.
T1082	System Information Discovery	Script collects basic host data (IP, username, computer name, privilege level).

Conclusion

• VIDAR leaves a distinct set of executable and behavioral indicators, including mutex/network anomalies and a broad theft profile, which makes it highly recognizable in sandbox telemetry.

• VENON is especially identifiable through the artifact C:\Users\admin\AppData\Roaming\hwid_sent.dat, together with its Rust-based banking RAT behavior, LNK hijacking, and DLL side-loading chain.

• SLOPOLY stands out due to the persistence log C:\Users\[^\\]+\\AppData\\Local\\Temp\\persistence.log, the Polymorphic C2 client started marker, and its scheduled task persistence under Runtime Broker.