Extracted

• • Target
    2026-06-04_b9ce02c63ceaf19ae17bf1e78bb07df3_snatch
  • Size 2.9MB
  • SHA256 6242beaa4fff92a0ac897b9006cd73718638296dcfef43ad696ecb24d77125fa
  • MD5 b9ce02c63ceaf19ae17bf1e78bb07df3
  • SHA1 0d8b4fc75bd3d36a03ade883782cd554d21f6538
  • SHA512 7bbdd8bf0bb9bd05c34ed87f36b2c0fab12c31e3a09f1a91c82e561e910a1302b564d5eab39031850e172d00c42b5ba37d070c90f67aa949a6e4c0fd25a3a896
  • SSDEEP 24576:jjNnlMryvgGPboko+cihb86Pv9ywHEyoGCQaVqqpNqAbxcQ1P6R/MBele5ZK2oe6:jjxlvvgoboQcih8Qv4wVoGClt1dqT
  • TLSH
    T1C3D538877862F9E2C829B2B36463417477A8AE107B71A7F7289C31751B332C449F6F94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  3bc41b1aa7524456de3f85c8d329d639credential_accessdiscoveryvidarspywarestealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2