Extracted

• • Target
    2026-11-05_6f861c900faa16598476591b83d3b304_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 95.1MB
  • SHA256 1459e229e3fd19bd355a5049bf281fca25a50eb927a4fe667ca6bbfb4bfcd87c
  • MD5 6f861c900faa16598476591b83d3b304
  • SHA1 2108622349411c78b95e14430866b449be5650fe
  • SHA512 c76ad63cb6d144116b2838d90c1e2a95ddae6a6fb2b8c54379349105da4473733a7af4ebf5bb83b5787dc9bd1b77f6f619bf816203b1bb055f3a178bf0a9fe4c
  • SSDEEP 1572864:HSAuDQjNxh3/H5GxQgOkKk7ftCOZp1e9MmyFJNdb2P1oTbLwiuFXPImNb9bsTfC:yA9Lh0CgAk70OZp1hpkOPeXQmV9A+
  • TLSH
    T18E283303F9A116AAD496AA70C9BB6253AA65BC4DF73533E72C0073302F397D17AB5305
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  21e3d733a7cf8047959116bf58a2cbcediscoveryvidarstealerdefense_evasion

  • Detects Vidar Stealer v4.0 and higher memory dump

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects executables referencing combination of virtualization drivers

  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2