General
-
Target
132289704de81e5014306f192b09c97c0252ce3fcc72d981779085e7b9a61cd0.exe
-
Size
1.9MB
-
Sample
240525-bfyeqsha7x
-
MD5
539811c87f4654f1665e9a49c5457066
-
SHA1
f7b825496b715d84c2e87d8b60ebcf7505b6cd4c
-
SHA256
132289704de81e5014306f192b09c97c0252ce3fcc72d981779085e7b9a61cd0
-
SHA512
a654a2554828998ffd91fd60288fcf740813e129b2b375a42eaad049cd5bc7868a755e120a5b195f578eac9adde463f5c5b926e8f89a69122f697bb73e199e4d
-
SSDEEP
49152:/fZTmjlVqD/zL8EDMGWUt9PZWQKzw65ZkzQuKAW1Db96jIt6:/xy3qD/zL8HUt9Ygq6MukPh
Static task
static1
Behavioral task
behavioral1
Sample
132289704de81e5014306f192b09c97c0252ce3fcc72d981779085e7b9a61cd0.exe
Resource
win7-20240221-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
132289704de81e5014306f192b09c97c0252ce3fcc72d981779085e7b9a61cd0.exe
-
Size
1.9MB
-
MD5
539811c87f4654f1665e9a49c5457066
-
SHA1
f7b825496b715d84c2e87d8b60ebcf7505b6cd4c
-
SHA256
132289704de81e5014306f192b09c97c0252ce3fcc72d981779085e7b9a61cd0
-
SHA512
a654a2554828998ffd91fd60288fcf740813e129b2b375a42eaad049cd5bc7868a755e120a5b195f578eac9adde463f5c5b926e8f89a69122f697bb73e199e4d
-
SSDEEP
49152:/fZTmjlVqD/zL8EDMGWUt9PZWQKzw65ZkzQuKAW1Db96jIt6:/xy3qD/zL8HUt9Ygq6MukPh
-
Detect Vidar Stealer
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables containing potential Windows Defender anti-emulation checks
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-