Extracted

• • Target

    2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom

  • Size

    1.3MB

  • MD5

    e9a4da7003603ce1d5045a8c7b44611d

  • SHA1

    5b51f43b8d16dea516abc5cf3231042a10ecf09c

  • SHA256

    bcba841ec1c29c8febe31bd52a06da1bbd88faa7aafca3c88aed068d83e07783

  • SHA512

    026432c88637fa22e2a1bb723d90249d1803e9f01f31d61bbd023198bdfe2304e279a954c07fbc92977f59453ab612a41630111845416f23ed4075fc7157e70f

  • SSDEEP

    24576:pXfINFPFU9z/46aw5vHZnWHItRf4fYRE7BHlcADadfj/EIS6CwvhYt4zju+p0juY:pXfINtFU9z/46aw5vHZnWHItRf4Qy7BR

  Score

  10^/10

  vidar05384aad30607e06c3d580d2ad87a31dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2