Extracted

• • Target

    2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom

  • Size

    799KB

  • MD5

    9d8735f3616aa80144974a74ddeb99fa

  • SHA1

    70414ba52fbfe2606e8fb08d43afbab4488628eb

  • SHA256

    fd39a100de7ae6efc732edeab31a89313d0be7e0540acffc04f6ed707c48c48d

  • SHA512

    231c202bfa703e3c0740b990344ee2903eceba15abb79add30a0690089eb12ec64a264301fd20c46f97eb6092e80b3dbc2227c1b447844a03a422689eb34c315

  • SSDEEP

    12288:dbGU3fK+OmAeJWcl28vZ2CYizu+9LKLdEEo4Edka+9LKLdEEo4Edk:ZGU3bNkAuaKLdjRaaKLdjR

  Score

  10^/10

  vidarc466785b3a34d7b3c4d6db04a068b664credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2