Extracted

Extracted

• • Target
    2026-10-14_ce8144286e438036dceb5a5593b8d420_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 14.2MB
  • SHA256 2684dd7946751a6b074e124ca46a5da4dca8f663152d219c1e5bb533f39f3149
  • MD5 ce8144286e438036dceb5a5593b8d420
  • SHA1 6b62457abedb635ae8c1846b353564bb5cfdd0ea
  • SHA512 0e793ec019b9780b5936de523af1572a45d5bf516448ba7df54a55414c51f47cb8ad6e8933a4258cdb22f23ac2e0a221354460b0485e572618d5abba84fc105c
  • SSDEEP 196608:lUgIRP7e9wRKzrhYEqjaY/4AQB7Osu/G+XoFD:lORDNEqm0496sBSoFD
  • TLSH
    T175E629257B9A99ACD05BC47482474A625E7170CB0B39B9FF449492383F7ABF42F38319
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f139972a13ea65d5e96996c8b4114c3cdefense_evasiondiscoveryvidarstealertrojan

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects executables containing URLs to raw contents of a Github gist

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2