General
-
Target
5dbb87520c278ce78dabbfc580ad7d068c6182af9f26ab87502f4166e400039e
-
Size
1.8MB
-
Sample
240526-d9qcbsdf3w
-
MD5
16e6462f5eda4abaf006fe402469fc4e
-
SHA1
334deeeda9415d9dc933ec17faf98e58dc3cf875
-
SHA256
5dbb87520c278ce78dabbfc580ad7d068c6182af9f26ab87502f4166e400039e
-
SHA512
0c788196898a6e2e8656136939b6682cba9fd2f1c306022343125bad3722a8ab061b529c4e9ace881f278e8ca38f397a04cd5637898b6045975dc7fa2bc30433
-
SSDEEP
24576:FBfuZfeq6sJO6hTdtTF+TxMoxQH1Tj4wtjYZH1DmoYYzi3WH45yv+OueSJhm9e:F7qFTJtTF+TxMoxc1TU+j+dAzGwlrh
Static task
static1
Behavioral task
behavioral1
Sample
5dbb87520c278ce78dabbfc580ad7d068c6182af9f26ab87502f4166e400039e.exe
Resource
win7-20240221-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
5dbb87520c278ce78dabbfc580ad7d068c6182af9f26ab87502f4166e400039e
-
Size
1.8MB
-
MD5
16e6462f5eda4abaf006fe402469fc4e
-
SHA1
334deeeda9415d9dc933ec17faf98e58dc3cf875
-
SHA256
5dbb87520c278ce78dabbfc580ad7d068c6182af9f26ab87502f4166e400039e
-
SHA512
0c788196898a6e2e8656136939b6682cba9fd2f1c306022343125bad3722a8ab061b529c4e9ace881f278e8ca38f397a04cd5637898b6045975dc7fa2bc30433
-
SSDEEP
24576:FBfuZfeq6sJO6hTdtTF+TxMoxQH1Tj4wtjYZH1DmoYYzi3WH45yv+OueSJhm9e:F7qFTJtTF+TxMoxc1TU+j+dAzGwlrh
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-