General
-
Target
file.exe
-
Size
432KB
-
Sample
240607-sqrhlsbc76
-
MD5
7dc8189f70cc34e18ea7af8fdeac4142
-
SHA1
8cb698efdf5971e0805dd0f0fb0457315490c777
-
SHA256
a3608a51db9df14c42f8c6e37ac49969de70b4be0862d82b5823c00aed395f9d
-
SHA512
9bb17829724af371d383874b8ed4efe09f7f518fa131d68dd02ae0a149b0506f42b2694d7ec9a59b591b28fdcd620b68116e1170cd489b396d294126332e93ac
-
SSDEEP
6144:+uvXVvZjkQbsWSHZhP2YQih4Qsc14gY8f4en6hZpG+es7SJnXZfGBTaDsj48bR4B:5vdkQbjcps2+8uhAs64TR47EO
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240419-en
Malware Config
Extracted
stealc
Extracted
vidar
https://t.me/r8z0l
https://steamcommunity.com/profiles/76561199698764354
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
file.exe
-
Size
432KB
-
MD5
7dc8189f70cc34e18ea7af8fdeac4142
-
SHA1
8cb698efdf5971e0805dd0f0fb0457315490c777
-
SHA256
a3608a51db9df14c42f8c6e37ac49969de70b4be0862d82b5823c00aed395f9d
-
SHA512
9bb17829724af371d383874b8ed4efe09f7f518fa131d68dd02ae0a149b0506f42b2694d7ec9a59b591b28fdcd620b68116e1170cd489b396d294126332e93ac
-
SSDEEP
6144:+uvXVvZjkQbsWSHZhP2YQih4Qsc14gY8f4en6hZpG+es7SJnXZfGBTaDsj48bR4B:5vdkQbjcps2+8uhAs64TR47EO
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-