Extracted

• • Target
    2026-06-06_25247e72144ae033ca036e3f5b55d90a_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
  • Size 2.3MB
  • SHA256 d3679374bc9028ec784bebb88665472d513d538ddbede73ae879ea61edb69e71
  • MD5 25247e72144ae033ca036e3f5b55d90a
  • SHA1 42916281c71b5e3dd4bee887334bcb3b121f5806
  • SHA512 9184f30103c7eaac3989c2b57108ffdbecc9d940140f3d66ed2c2141c2c142206ac0696fb72c30db891a98e31072a813ef1f9f787b0d7f1e3a5171d628c8fde6
  • SSDEEP 49152:FN8PFwqOFIrb/TlvO90d7HjmAFd4A64nsfJ0LF5lspmF/nOWbL6Ge5DxZgEnhXP/:FmMS55ls8F/nOWbL67N
  • TLSH
    T19EB58D02BC9424BAC9EA933289B552A17730B8590B3177C32F51B7B92F777E80E79354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  3bc41b1aa7524456de3f85c8d329d639discoveryvidarspywarestealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2