Extracted

• • Target

    2025-04-20_7f8e5fe3443a730c3b55e170ed25e7a8_black-basta_cobalt-strike_ryuk_satacom

  • Size

    808KB

  • MD5

    7f8e5fe3443a730c3b55e170ed25e7a8

  • SHA1

    5ad4bb5a34b5906f99eb3bdedb48bc517d18136b

  • SHA256

    7c1bb5e9ae1bf20dc9aafb0605b15bd688f7d5e23db424e019315f412f11ec42

  • SHA512

    e9f7a3565868a606906d757bb1e751586685038761e8aba38e3c9156235a1280d23fbe950ccb45d545d854d545da714bb07b90ee8eaf1b28f10214fca612f516

  • SSDEEP

    12288:zbGU3fK+OmAeJWcl28vZ2CYizu+9LKLdEEo4E7ka+9LKLdEEo4E7kaEO:vGU3bNkAuaKLdjDaaKLdjDat

  Score

  10^/10

  vidar0259016785c18ed951c497596f76958ccredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2