Extracted

• • Target
    2026-10-31_d02f0991d0fba5d1a5aec383d193a3a3_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 3.2MB
  • SHA256 359a7c8a50391ee13a1651b67b118fe7ab6ef6ddeae39876a393857fbfdc692b
  • MD5 d02f0991d0fba5d1a5aec383d193a3a3
  • SHA1 693d5a1c24b152cea53ddb1051adf99696a95f8e
  • SHA512 78357f23b199170a255ee48cfbe2036c6b455d384e550a7238f82ee452aeb7d4be48bd467eb7530e85f45ee45f2c256b11d4326ecd1b6c86c39250236137f985
  • SSDEEP 49152:H00bcxKdkkaEZPV2UxuiDcpxQdQa5i+a6bS:H1HtDcUdQJ+O
  • TLSH
    T134F57D07BCE459AED0A6A631C8B75142BBB07C441F3173D32F40BA782E767D49A79B48
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryvidarstealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables referencing combination of virtualization drivers

  • Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2