General
-
Target
d89896bd803c9124b8072a1cce087f285a602a5ccd3fb336875f61c24f8d1efc
-
Size
2.0MB
-
Sample
240526-ytj6laac4z
-
MD5
8db3b6439ee3d0b8152d67d24db349c4
-
SHA1
a6791899346dc49c9913f1c1f42032690790337c
-
SHA256
d89896bd803c9124b8072a1cce087f285a602a5ccd3fb336875f61c24f8d1efc
-
SHA512
e2d7ae36661690e2f4555c459f6fe970522504f4789ffa2ae1685948798357ffb2bd7e7bcbdb4beb7a1c0b09a9091951accb47723d114bc11dc0e4884d1a8ee7
-
SSDEEP
49152:OePpQEpJtTF+TxMoxc1TU+j+dAzGwlrh:OePpQEptIuoITsdZ
Static task
static1
Behavioral task
behavioral1
Sample
d89896bd803c9124b8072a1cce087f285a602a5ccd3fb336875f61c24f8d1efc.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
d89896bd803c9124b8072a1cce087f285a602a5ccd3fb336875f61c24f8d1efc
-
Size
2.0MB
-
MD5
8db3b6439ee3d0b8152d67d24db349c4
-
SHA1
a6791899346dc49c9913f1c1f42032690790337c
-
SHA256
d89896bd803c9124b8072a1cce087f285a602a5ccd3fb336875f61c24f8d1efc
-
SHA512
e2d7ae36661690e2f4555c459f6fe970522504f4789ffa2ae1685948798357ffb2bd7e7bcbdb4beb7a1c0b09a9091951accb47723d114bc11dc0e4884d1a8ee7
-
SSDEEP
49152:OePpQEpJtTF+TxMoxc1TU+j+dAzGwlrh:OePpQEptIuoITsdZ
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-