Extracted

• • Target

    2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom

  • Size

    1.9MB

  • MD5

    93079de0bd272e60957277651faba8e6

  • SHA1

    6881ba19895707f88b3a25dace643ee450d5e978

  • SHA256

    87456e358fac3b5c8c3c1997cc4b5a4c692073972a08033837f15d022086668c

  • SHA512

    127a1db9614d1a0f9da080a83ee260e47eb604baf7f412c690e0f908f27db32620d2bd28a6c4487c99db944a10816db0d035891ca69dc2b3a26001059e1f70f3

  • SSDEEP

    24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwGlUR:LnFFytugGlUR

  Score

  10^/10

  vidar861aaf32ff897d13c49344e110765213credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2