Extracted

• • Target

    2025-02-08_d41aed28538e53598c5ee0b61a7474fb_frostygoop_poet-rat_snatch

  • Size

    6.4MB

  • MD5

    d41aed28538e53598c5ee0b61a7474fb

  • SHA1

    29a1d2fda339625e15739e193fffafe3a636f8b9

  • SHA256

    03f111a7553d3e698a07aea301f9be5d29bcde70513a1323283db3e2e4045d95

  • SHA512

    3eec7324c3c4091d5809b4dfcdece50172619a85c3e5405c7bd76701f69c38b8e80c1ae5a93cfc8fd3834c268776dca95ace24eabe8409eec061114fa79d12e3

  • SSDEEP

    49152:bDZuiC6tkhmcPaGJDVoAVlK+Cw3PKiRasKSjKOTmxECtWBR3xKIygAvKY7orrTKI:bNuinaYcPLZWA1PKE0f6K9v0KVio+

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2