Extracted

• • Target

    2025-03-31_bb2e05095585306c7795f0d868c35c7b_black-basta_cobalt-strike_ryuk_satacom

  • Size

    694KB

  • MD5

    bb2e05095585306c7795f0d868c35c7b

  • SHA1

    1d812f7f3c5cd4ac12c978832ce0e1a7914fc7dd

  • SHA256

    0ae4a1fe7de1a44c85893f600f29e28ff2d859f5c99261a4ac8ce0272a15c2e5

  • SHA512

    543867f1e1c2450fdb5e072d32e050d5a2123cac8db69065b3bc172dfdad736018979ff872743e5b35e94982c0341b0ea59c7afcd253d6089d3dedf89dda8784

  • SSDEEP

    12288:m7athgvR/PNiavyws5SXvTbhX2NWUXEAuT32JrZwxRlUE2JrZwxRlUR:mem/E/ob86mpZwblUJpZwblUR

  Score

  10^/10

  vidarfa58002947e44c326351a19585a38169credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1