Extracted

• • Target
    2026-11-05_84932cff42e9f1e57f90f883750f30ae_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 87.5MB
  • SHA256 694e7621b0249a383fa2e14784176db42d36844e75c85dce6dea3eb10aacccf5
  • MD5 84932cff42e9f1e57f90f883750f30ae
  • SHA1 cd18f4808180687ed42b47e48257fdea4572fd2d
  • SHA512 13b3d12a8eea671f7d7fb738baa1f491d78dd110234beb9a451a64d902acd856a0bbd6aea9f2b5ef2fabf5134753e4a6a39e9dd8445e06293cb8f466ffbf954e
  • SSDEEP 1572864:zQtQQvsf2GkKUKMemXONSpsnQzpYhtugeiZ7v9NYmJv0ZSScSX6FB2G41mTPGz0o:zSof2QwXOGsQzpYHheixv9+FZSLbSmTC
  • TLSH
    T1AF183306EEA1687FD09AD638846A51427BB87C8CA73133D71F50B6792E323D16CB8F54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  24363f2788e69f30ea360d7df52b3192defense_evasiondiscoveryvidarstealer

  • Detects Vidar Stealer v4.0 and higher memory dump

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects executables referencing combination of virtualization drivers

  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2