Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    669bf5c2ac07ee03481ce14ec01ec34deccb7811f022101c08d23cb6e7590764

  • Size

    2.0MB

  • Sample

    240527-cphajsdf42

  • MD5

    60723429452f83035a5436d3c57c4f26

  • SHA1

    97572400c6eabe8130dfa621902723122691d9a5

  • SHA256

    669bf5c2ac07ee03481ce14ec01ec34deccb7811f022101c08d23cb6e7590764

  • SHA512

    e06e0232f861b4c38de69c8301a573d38d5c1b44b2d92e59c6898d88be9d2e9ded453256e6cf6354583e7afc74c13ad66c6e3ad7893b4c2b26f6a48188087e12

  • SSDEEP

    49152:OePpQE9JtTF+TxMoxc1TU+j+dAzGwlrh:OePpQE9tIuoITsdZ

Score
10/10
stealcvidardiscoveryspywarestealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Targets

    • Target

      669bf5c2ac07ee03481ce14ec01ec34deccb7811f022101c08d23cb6e7590764

    • Size

      2.0MB

    • MD5

      60723429452f83035a5436d3c57c4f26

    • SHA1

      97572400c6eabe8130dfa621902723122691d9a5

    • SHA256

      669bf5c2ac07ee03481ce14ec01ec34deccb7811f022101c08d23cb6e7590764

    • SHA512

      e06e0232f861b4c38de69c8301a573d38d5c1b44b2d92e59c6898d88be9d2e9ded453256e6cf6354583e7afc74c13ad66c6e3ad7893b4c2b26f6a48188087e12

    • SSDEEP

      49152:OePpQE9JtTF+TxMoxc1TU+j+dAzGwlrh:OePpQE9tIuoITsdZ

    Score
    10/10
    stealcvidardiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks