Extracted

• • Target
    2026-08-14_b5445af6b09f50846df40d7341486eed_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 3.5MB
  • SHA256 4e7e19d76f05a72639cca5b90c209e80c2474d4a90b88c9df8a57511ca1254c7
  • MD5 b5445af6b09f50846df40d7341486eed
  • SHA1 f60ca854046466b5163fb9c213b7dae6cb9765f3
  • SHA512 e247b6003211815d1177383d78188891d1708f40e5145500790e03aadbb5a1336e275a203f037059024dbe297bbc174edef0f7436edffb0f3d2c318b304eddef
  • SSDEEP 49152:FQgPfPfayA0Zyl7a3cvYqMgvyvGCsULAomOfGDyPIgMFVh7w:FV3glnvYqMgvy7sULVmO+DyPIgMFX7w
  • TLSH
    T1AB069D03BE9040E5C896A73289778562BB61BC0C473533DB1EA0A7742FB67D25E7AF41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5fdb6df778631818165110294c620890discoveryvidarspywarestealercredential_accessdefense_evasion

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2