Extracted

Extracted

• • Target

    2025-05-16_0d81648f2a54a40be7fcb57bc3209aee_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer

  • Size

    938KB

  • MD5

    0d81648f2a54a40be7fcb57bc3209aee

  • SHA1

    971859c5430c0d58f7f5df004898c07a4b19890b

  • SHA256

    5ddcb268ab3c6e2e8eb3370f990f48fc1825fd67c121789bb7df9e172860c00f

  • SHA512

    6379312ba296cc44a52d6df36223b8880217a00823a67b7a5f29d4191a50af0b74aea431aa101bab0b8fc2088243af5292091f2ba0a8fbdea4f1c11d3bccf6ee

  • SSDEEP

    24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aM3b:6TvC/MTQYxsWR7aM3

  Score

  10^/10

  vidar54911ccfd8045c892eac97c18f773c50credential_accessdefense_evasiondiscoveryexecutionspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1