General
-
Target
b8d9230312ce7eacf9b5f7e0d2646333ba217803e3c895aac4f6a811a5987161
-
Size
2.0MB
-
Sample
240526-vq1sdsed96
-
MD5
b7a39ab5c0606b40e68a73f27c2144ce
-
SHA1
fdce688384285ca7b474a7f1f042a53ddbbce79f
-
SHA256
b8d9230312ce7eacf9b5f7e0d2646333ba217803e3c895aac4f6a811a5987161
-
SHA512
7c2ad589f7a9178612ba9ecc77a69dac1f3cb0ebb776d390bbe2ffd54d88a0109c9392d2986e6b2b0c15d9de7394f816e22c146b11683b777c64c98b161f6274
-
SSDEEP
49152:OePpQEFJtTF+TxMoxc1TU+j+dAzGwlrh:OePpQEFtIuoITsdZ
Static task
static1
Behavioral task
behavioral1
Sample
b8d9230312ce7eacf9b5f7e0d2646333ba217803e3c895aac4f6a811a5987161.exe
Resource
win7-20240221-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
b8d9230312ce7eacf9b5f7e0d2646333ba217803e3c895aac4f6a811a5987161
-
Size
2.0MB
-
MD5
b7a39ab5c0606b40e68a73f27c2144ce
-
SHA1
fdce688384285ca7b474a7f1f042a53ddbbce79f
-
SHA256
b8d9230312ce7eacf9b5f7e0d2646333ba217803e3c895aac4f6a811a5987161
-
SHA512
7c2ad589f7a9178612ba9ecc77a69dac1f3cb0ebb776d390bbe2ffd54d88a0109c9392d2986e6b2b0c15d9de7394f816e22c146b11683b777c64c98b161f6274
-
SSDEEP
49152:OePpQEFJtTF+TxMoxc1TU+j+dAzGwlrh:OePpQEFtIuoITsdZ
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-