Extracted

• • Target

    2025-02-13_7ca1a467d3565e8827428ac7be5b7bf6_frostygoop_poet-rat_snatch

  • Size

    5.1MB

  • MD5

    7ca1a467d3565e8827428ac7be5b7bf6

  • SHA1

    63a893bf674933c34cbe216b49722ad18d625fc6

  • SHA256

    efbd528c8ed8c5253b5e191eedc85e30f75778a417b5f427da115e7f44d9dd47

  • SHA512

    9be0926ef5c388853cd7560afdbd97d0f47265b3bef47cefbaaa65c33593e2eb525da9f58079c9411e87ad4a184eff49021fc982bfafe030a55272a311228720

  • SSDEEP

    49152:YVotF0OLNzFMg3PVyj+ikV/rX/qyzPKO93t0jc6MVh3dd6vE/68u86k1G:YsmOLTJVySl5rFPKOH/IL

  Score

  10^/10

  vidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2