Extracted

• • Target

    2024-10-29_45f6af3f1ad22c109e6d1792de150d6e_poet-rat_snatch

  • Size

    24.7MB

  • MD5

    45f6af3f1ad22c109e6d1792de150d6e

  • SHA1

    5fc5bc9c90ee17197abdec68b6bf1e4a04f62d3c

  • SHA256

    6dfe4ea4f42f1cd4111a449e6fcae596c3884f6016f0ed5d0f36adff1acf0d88

  • SHA512

    e328e51323889f5620aa734ab057c266a0fac7a843442aed5192b6d74b8cee4a6a0ea0e0698d40f1f9b4922e2cb6c58dd18e52e206fa388e668e6557e76e06e5

  • SSDEEP

    98304:XvkH7wY4yuW07JJkTXzEuo70QfTIgQBojs+5qSyHSgCBOvMOefSQOMaHH0+nn87b:fkb7CzTmKjs/HjCYkOeCMa0+nn8/CEb

  Score

  10^/10

  vidarcredential_accessdiscoverystealerspyware

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2