General
-
Target
f52736725becf7ebdc285e669e7bf3dd59fdca05cd07795fa208aaf8c0be6c7e
-
Size
2.0MB
-
Sample
240525-sheh3sge8x
-
MD5
e3fac3c18572b3f9d3bb7a62d8f9e8e5
-
SHA1
a13616d75b89bb5b725afc25cb9db8d738a056f3
-
SHA256
f52736725becf7ebdc285e669e7bf3dd59fdca05cd07795fa208aaf8c0be6c7e
-
SHA512
427be798230bf4be3612562919a8bbc802c10a1768a88e76d92c0af4690bdd750e8fcc4624b391aa46ca640564184aec8e1e278c539ee2d2c3336f3ed603a217
-
SSDEEP
49152:s4K3x1vUWJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18WtIuoITsdZ
Static task
static1
Behavioral task
behavioral1
Sample
f52736725becf7ebdc285e669e7bf3dd59fdca05cd07795fa208aaf8c0be6c7e.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
f52736725becf7ebdc285e669e7bf3dd59fdca05cd07795fa208aaf8c0be6c7e
-
Size
2.0MB
-
MD5
e3fac3c18572b3f9d3bb7a62d8f9e8e5
-
SHA1
a13616d75b89bb5b725afc25cb9db8d738a056f3
-
SHA256
f52736725becf7ebdc285e669e7bf3dd59fdca05cd07795fa208aaf8c0be6c7e
-
SHA512
427be798230bf4be3612562919a8bbc802c10a1768a88e76d92c0af4690bdd750e8fcc4624b391aa46ca640564184aec8e1e278c539ee2d2c3336f3ed603a217
-
SSDEEP
49152:s4K3x1vUWJtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex18WtIuoITsdZ
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-