Extracted

• • Target

    2024-09-18_61c50649f5cac9417c8a3f98b4dbea7d_poet-rat_snatch

  • Size

    9.5MB

  • MD5

    61c50649f5cac9417c8a3f98b4dbea7d

  • SHA1

    1280f3e527348b8a0b1451a1aee642a0065144b1

  • SHA256

    8dfed947e7a4f2969a9dc77889184ff6e377802ac46668944273456bf298dcc1

  • SHA512

    75f6df053e3893523b4470ab7c898ebe1f43a42d9b6926025a68144cabba5dd45411fbb425b25bc62495f722ba0377e3aa13cd5cf80dbf6793e23bbb22175690

  • SSDEEP

    98304:eNz/SxphfYTTNmyCyxZy5zBKfSkIwzkzBtGE0GM:8+lYdZsgfSxQ

  Score

  10^/10

  discoveryvidarcredential_accessspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2