Extracted

• • Target

    2024-11-06_252a391e6fa9d2f236e463a21561b989_poet-rat_snatch

  • Size

    6.2MB

  • MD5

    252a391e6fa9d2f236e463a21561b989

  • SHA1

    7e9abd3ec7f47c58bb5aaa3cd1528aa02abfda55

  • SHA256

    d1e86d67050094cadd2d25db98861777a465a8f09eb1f7f5eed6cf9a948604a1

  • SHA512

    15b62c93437ca65612dd2d498eda7057a7c8bc5e81d81c32011aa40cdef711c6204a13cdfb85565021b0e61e2aa699ce9575927b33942d12cca40f5cfdb62064

  • SSDEEP

    98304:wTiMEvjmzKewwsZ2XoCx7fR+Q6VCKrUk:WiMEaI24C1UQszrU

  Score

  10^/10

  vidarcredential_accessdiscoverystealerspyware

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2