Extracted

• • Target

    2025-02-07_b2001556255de91fac3580c11798ab55_frostygoop_hijackloader_poet-rat_snatch

  • Size

    4.5MB

  • MD5

    b2001556255de91fac3580c11798ab55

  • SHA1

    3401301680f24e7cca14656a803fe725e961bec9

  • SHA256

    7c0d04c2bd129c20a9e836954e548482b7c54db3612076f1113909495f052db9

  • SHA512

    54c733c5a0d461d4ab0d18e63d2b960e6d6a07163bee29d81b23354f0886bb2cd90452ca0b6008800a7e8f471894d095ba97b4b697efd53aefcbfa552740a7e2

  • SSDEEP

    49152:wYAyOIfdsbFR+ywdYFe0vLTj8TLVwl9q3PnPkGVzM2c4SQjFf6x1to3:w7yOMQR+ywWw04T5nmujMo3

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2