Extracted

• • Target

    2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom

  • Size

    1.9MB

  • MD5

    ba7cfbfe4ee11ed0bb81a7b71de91922

  • SHA1

    08f3a7cd51e1ea055ff7fbdcbd93c08b689773bc

  • SHA256

    49c8db48c43861be5087f96e5f934f8f6e3a3931e75613fd87127fa29edd62f1

  • SHA512

    3121d0f1e389d9f9b5faeebfa35e1a218f1a5c594beac41106c5cb85c5f6f7a6ffbab58035517833c36d6a42550156e19d0d832c80742264b4cdfb68d61175b6

  • SSDEEP

    24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZw1lUR:LnFFytug1lUR

  Score

  10^/10

  vidar23b8a0e48f77dc82cb41b2936121fd07credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2