Extracted

• • Target

    2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader

  • Size

    1.3MB

  • MD5

    f673ead8ea61be7cd25a6bc11aa8f921

  • SHA1

    d7cae6301dfc7e6a3049653f6d6e3b3cbbb52ca7

  • SHA256

    3ceea626c1796347ccdf784ca0477992c39248d5f83851649e50d72df135becb

  • SHA512

    5cf93bf8b9d91059f0e9b172c85cb5b4f2d1baac1ea83b354eac3400b414f8575c5a14e6332ff7736c00da0cfe81983c71b78189dda7d51bac1b93f982325484

  • SSDEEP

    24576:MSoc97WbdaoDJ0ialHJ1hs+aeOWwjQ6VgL9pXW+hJdK1JNm:Ac97UN161hs+aaqgL9pGkJdK1JY

  Score

  10^/10

  vidar7a48c83a230d8076280af316c6d72f8fcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2