Extracted

• • Target
    2026-08-14_231cc2ec458d42391530f1adfe88e401_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 3.2MB
  • SHA256 c2000f19d9ece5806e89b02510f65e30aeb0fa39ac0d499069af4d67b3e717f2
  • MD5 231cc2ec458d42391530f1adfe88e401
  • SHA1 90f94439eebf249c0e3511fe0c9362e5ebbe58a7
  • SHA512 73fd397b68bb47dfda644d9d52fbc998c18d2ea1d6c627bd375ca0509d86084697448a1ff8518ffa7aae86c844a06f5ba341bae14e35fbedb908bab96c14b5be
  • SSDEEP 49152:+j+kg6Yyunf9OvpuAWuBGa7cZsAJmCR6Vsj8TsVIgG7FVoukHqYdfnGFNG:+LLyAuAHGmAJmvCjHtOLafncG
  • TLSH
    T1C6E59D0B7C9140F9C4AEAB31C9762255B761BC5D8B3533E72EB0AA742EB23D05D39B41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5fdb6df778631818165110294c620890discoveryvidarspywarestealercredential_accessdefense_evasion

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2