Extracted

• • Target

    2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom

  • Size

    1.9MB

  • MD5

    b909c5c9651fa47d445718066795926b

  • SHA1

    c93031fac22a12b64dee3c745dd6d31ca35ea484

  • SHA256

    374bec44744d1a5bf3ba7f9fdcab61f6e7bc9d748535d491119cf9c010f9222d

  • SHA512

    691fd17a2a9e2db4e4e41c96c4d0825037d34bcf8920d3bcd70dd787bfc7e942f1f3ea6542a80793c8474a04ffcb213f75887d604eeec9e4bce7cbddd20c460a

  • SSDEEP

    24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwulUR:LnFFytugulUR

  Score

  10^/10

  vidar80926b0860f8c2159b69dc78513fdf83credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2