General

  • Target

    9355fdd4dea3400b830900776fc1d9271991cc988b6b28c43d93a5f80d0a1ead

  • Size

    2.4MB

  • Sample

    240601-jqs7rsfd33

  • MD5

    7a915faabfb7e27e52f0e301f5692945

  • SHA1

    55065078364d9edef2256ebf7c5aea6f080afc13

  • SHA256

    9355fdd4dea3400b830900776fc1d9271991cc988b6b28c43d93a5f80d0a1ead

  • SHA512

    fc05591458bfbb72d27dbfd0dfdb69edff29d1fa9625da76ea63d475d2cf79ca378cae941e8150237ad3cd778fc70b18a698422ae29f05c977d03db2434407b6

  • SSDEEP

    49152:jxIRJF1HL+VdX68kUqJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dqtIuoITsdZ

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Targets

    • Target

      9355fdd4dea3400b830900776fc1d9271991cc988b6b28c43d93a5f80d0a1ead

    • Size

      2.4MB

    • MD5

      7a915faabfb7e27e52f0e301f5692945

    • SHA1

      55065078364d9edef2256ebf7c5aea6f080afc13

    • SHA256

      9355fdd4dea3400b830900776fc1d9271991cc988b6b28c43d93a5f80d0a1ead

    • SHA512

      fc05591458bfbb72d27dbfd0dfdb69edff29d1fa9625da76ea63d475d2cf79ca378cae941e8150237ad3cd778fc70b18a698422ae29f05c977d03db2434407b6

    • SSDEEP

      49152:jxIRJF1HL+VdX68kUqJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dqtIuoITsdZ

    • Detect Vidar Stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks