Overview

overview

10

Static

static

3

e4fc60066a...ff.exe

windows7-x64

10

e4fc60066a...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4fc60066af1811f56f60ce9ca1e1f6441dacea1c86f9377cf1b6aece6d1e8ff.exe

  • Size

    2.0MB

  • Sample

    240522-xbbk3acd74

  • MD5

    e36d7e8f26d145e7ade764b81ffc8b32

  • SHA1

    11f97d0df9715e1a4ee9a655aa918bfddc0598d0

  • SHA256

    e4fc60066af1811f56f60ce9ca1e1f6441dacea1c86f9377cf1b6aece6d1e8ff

  • SHA512

    40f5384bed8c3a353d33d7a85322ef00101f13c0ac48a7a322ba09ddda0548e1347056ba05e1ac5aaf80404861e0a71ab32f98950571526bb019cc37890dc2e5

  • SSDEEP

    49152:7QzHt472DcJtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtytIuoITsdZ

Score
10/10
stealcvidardiscoveryspywarestealer

Malware Config

Extracted

Family

stealc

rc4.plain

Targets

    • Target

      e4fc60066af1811f56f60ce9ca1e1f6441dacea1c86f9377cf1b6aece6d1e8ff.exe

    • Size

      2.0MB

    • MD5

      e36d7e8f26d145e7ade764b81ffc8b32

    • SHA1

      11f97d0df9715e1a4ee9a655aa918bfddc0598d0

    • SHA256

      e4fc60066af1811f56f60ce9ca1e1f6441dacea1c86f9377cf1b6aece6d1e8ff

    • SHA512

      40f5384bed8c3a353d33d7a85322ef00101f13c0ac48a7a322ba09ddda0548e1347056ba05e1ac5aaf80404861e0a71ab32f98950571526bb019cc37890dc2e5

    • SSDEEP

      49152:7QzHt472DcJtTF+TxMoxc1TU+j+dAzGwlrh:7QzHtytIuoITsdZ

    Score
    10/10
    stealcvidardiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks