Extracted

• • Target

    2024-09-07_25c97de06e1600f6261e2cae24255c50_poet-rat_snatch

  • Size

    15.0MB

  • MD5

    25c97de06e1600f6261e2cae24255c50

  • SHA1

    533f0e11fe9609447ccb77152f4346a558c935a8

  • SHA256

    9565b4b2b515302acdfb398873fc1b710d35b7b8d1d24bb4252ef805e3358715

  • SHA512

    5c9aa5a8901ec560d4e7de4f57f01eec8ad9f295a91d182426c51cd4edac582383d685a74283784a8f9e182f7624d1fd6ccd469bdea221b446dac9cc4d4f3c44

  • SSDEEP

    98304:l3tK33tgdTr5FI693xeiPR1tpar2oUdazIelLd5fFHibVD/o9+6ekws07/j/oU/Q:Otg11i+GOdOIeNddhiRMyszoeT42

  Score

  10^/10

  vidar99a9950fed7b1d95c81a34479cfbefe2credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2