General
-
Target
8380c34064009ad4dbae47b7f7b8ebbca3d03d949afddc3d5b91b5eee79d1ae4
-
Size
2.0MB
-
Sample
240526-28k8zsge96
-
MD5
4517bbea31cf57c66a1292d17968d4fa
-
SHA1
e24bee8a67e0c8bfc16cb54ea2894f38143b3e57
-
SHA256
8380c34064009ad4dbae47b7f7b8ebbca3d03d949afddc3d5b91b5eee79d1ae4
-
SHA512
f3e25d6df7c5a485c2d9579158c821b216f0ee6878332122e1eaf536f390b95738fcd64481da817bd77da40f5070ad08a9e43ee06013da3aaddff87a5f22f442
-
SSDEEP
49152:OePpQE9JtTF+TxMoxc1TU+j+dAzGwlrh:OePpQE9tIuoITsdZ
Static task
static1
Behavioral task
behavioral1
Sample
8380c34064009ad4dbae47b7f7b8ebbca3d03d949afddc3d5b91b5eee79d1ae4.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
8380c34064009ad4dbae47b7f7b8ebbca3d03d949afddc3d5b91b5eee79d1ae4
-
Size
2.0MB
-
MD5
4517bbea31cf57c66a1292d17968d4fa
-
SHA1
e24bee8a67e0c8bfc16cb54ea2894f38143b3e57
-
SHA256
8380c34064009ad4dbae47b7f7b8ebbca3d03d949afddc3d5b91b5eee79d1ae4
-
SHA512
f3e25d6df7c5a485c2d9579158c821b216f0ee6878332122e1eaf536f390b95738fcd64481da817bd77da40f5070ad08a9e43ee06013da3aaddff87a5f22f442
-
SSDEEP
49152:OePpQE9JtTF+TxMoxc1TU+j+dAzGwlrh:OePpQE9tIuoITsdZ
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-