Extracted

• • Target

    2025-03-31_61903c7168838b2fd1c701756d1efb15_black-basta_cobalt-strike_ryuk_satacom

  • Size

    1.9MB

  • MD5

    61903c7168838b2fd1c701756d1efb15

  • SHA1

    918de67ab700e3856d6ee40d239e68c0e806d11f

  • SHA256

    e705563d5634d217e0ebb3dcde0326e0cae0d57bc866871d8f4032747c8347f6

  • SHA512

    5f513cbc9e3fba4c3c0707d3ebca755664b09a8e8ce796826036a57b2ad6a6eec7dfa1b9fcec1b99af696bac71fbb6cfd0254f841e1dd466f3d7b61f4edf4c3c

  • SSDEEP

    24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwglUR:LnFFytugglUR

  Score

  10^/10

  vidar286abd424eeeb855a080435369086f7fcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1