Extracted

Extracted

• • Target
    2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike
  • Size 5.0MB
  • SHA256 a0c4faaa16d893503f915c69548418a9f1500236885b16026a8e6758f7d414aa
  • MD5 708d3d81b162487b8e1e1ec4d0cc1f1b
  • SHA1 9a0a790cb536228d8f3af3d797497191037768d4
  • SHA512 fdae8e46e5e2971167ea0f382e1a178f792a02363066af09f62b5582f9194ba005c2f6b8b155e45a936d65ba7476f08848d8600b2aa44d11e177eb820980dd79
  • SSDEEP 49152:LzXg9M/MBbmWhZuozUiiqXdxNr3X/Sg+MUst1gD1p82N/3:L3UsksiiedvPZzQ/3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  0473ab0852fb153f2f2a3f2bde94a4dc1111discoverystealcvidarspywarestealer

  • Detects Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2