Extracted

• • Target
    2026-07-28_8b2af839f1ce1709563b685a64282eb0_cobalt-strike_elex_glassworm_icedid_stealc_vidar
  • Size 393KB
  • SHA256 2db8be4701751d2cb69f3004939826181ca09faf04ecbe0511322e21cf5955a6
  • MD5 8b2af839f1ce1709563b685a64282eb0
  • SHA1 94d45788ab79c803d0a2b81e4b38fe8d528a503f
  • SHA512 6fe27be9464e73f3974ed92bcff8efd6f94ee4cea9a2c3ea2225195375ecb20b3fee3891559514e01728bfe5aa0d38488babbb840d6cbf525f9caafcd66d6900
  • SSDEEP 12288:KE2i3KghRiAqqUEGy60dKb1L0VYExdZaZ:KE2i3KghRiAqqUEGy6AKb15O
  • TLSH
    T116849D1623E130F6E2225534BA498621CB7B78341A22F75FABC805655FF67C1EE2C71B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  8ecc9c7eaebfdf2a8cc0586d7419d6eacredential_accessdefense_evasiondiscoveryexecutionvidarspywarestealer

  • Detect Vidar Stealer

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2