stealc

General

Target

1328f330d88fc6c57268ac0495f665a09db19147ae3819107dfabc079f4bf7b6.exe
Size

1.1MB
Sample

240528-bev8zshh78
MD5

7e6dee5e49cce77c1ed5d9590f91ba56
SHA1

923137ff5f8ebfed39f43e1711c6cf5508ce5b16
SHA256

1328f330d88fc6c57268ac0495f665a09db19147ae3819107dfabc079f4bf7b6
SHA512

f20159f092faa00564b2274c2e733cf0fb01b0a785395fb71c8770b6c56ee2027b42cb52b9e4c8037fc9fd33d2984ef36d8b9b03a73072425d262dbe7c4e3083
SSDEEP

24576:13AHDAjFNUIRMOkZD+LIGnB8i04cQinbyTn4P0eSYvhZ:13AzIRPkZD+LHp0/QXr/el

Score

10^/10

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Targets

- Target
  
  1328f330d88fc6c57268ac0495f665a09db19147ae3819107dfabc079f4bf7b6.exe
- Size
  
  1.1MB
- MD5
  
  7e6dee5e49cce77c1ed5d9590f91ba56
- SHA1
  
  923137ff5f8ebfed39f43e1711c6cf5508ce5b16
- SHA256
  
  1328f330d88fc6c57268ac0495f665a09db19147ae3819107dfabc079f4bf7b6
- SHA512
  
  f20159f092faa00564b2274c2e733cf0fb01b0a785395fb71c8770b6c56ee2027b42cb52b9e4c8037fc9fd33d2984ef36d8b9b03a73072425d262dbe7c4e3083
- SSDEEP
  
  24576:13AHDAjFNUIRMOkZD+LIGnB8i04cQinbyTn4P0eSYvhZ:13AzIRPkZD+LHp0/QXr/el
Score

10^/10

stealc vidar discovery spyware stealer
- Detect Vidar Stealer
  stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing potential Windows Defender anti-emulation checks
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect Vidar Stealer

Vidar

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects Windows executables referencing non-Windows User-Agents

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing potential Windows Defender anti-emulation checks

Downloads MZ/PE file

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2