Overview

overview

10

Static

static

1

#)#NEw_Set...up.exe

windows7-x64

10

#)#NEw_Set...up.exe

windows10-2004-x64

10

#)#NEw_Set...in.dll

windows7-x64

1

#)#NEw_Set...in.dll

windows10-2004-x64

1

#)#NEw_Set...ws.dll

windows7-x64

1

#)#NEw_Set...ws.dll

windows10-2004-x64

1

#)#NEw_Set...40.dll

windows7-x64

1

#)#NEw_Set...40.dll

windows10-2004-x64

1

#)#NEw_Set...in.dll

windows7-x64

1

#)#NEw_Set...in.dll

windows10-2004-x64

1

#)#NEw_Set...in.dll

windows7-x64

1

#)#NEw_Set...in.dll

windows10-2004-x64

1

#)#NEw_Set...40.dll

windows7-x64

1

#)#NEw_Set...40.dll

windows10-2004-x64

1

#)#NEw_Set..._1.dll

windows7-x64

1

#)#NEw_Set..._1.dll

windows10-2004-x64

1

#)#NEw_Set...pp.dll

windows7-x64

1

#)#NEw_Set...pp.dll

windows10-2004-x64

3

#)#NEw_Set...in.dll

windows7-x64

1

#)#NEw_Set...in.dll

windows10-2004-x64

1

#)#NEw_Set...1].exe

windows7-x64

1

#)#NEw_Set...1].exe

windows10-2004-x64

1

#)#NEw_Set...1].exe

windows7-x64

1

#)#NEw_Set...1].exe

windows10-2004-x64

3

#)#NEw_Set...1].exe

windows7-x64

1

#)#NEw_Set...1].exe

windows10-2004-x64

1

#)#NEw_Set...-1.dll

windows10-2004-x64

1

#)#NEw_Set...-0.dll

windows10-2004-x64

1

#)#NEw_Set...-0.dll

windows10-2004-x64

1

#)#NEw_Set...-0.dll

windows10-2004-x64

1

#)#NEw_Set...-0.dll

windows10-2004-x64

1

#)#NEw_Set...-0.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38.zip
  • Size 14.8MB
  • Sample240616-bdhlhaseng
  • SHA256 12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
stealcvidardiscoveryspywarestealer

Malware Config

Extracted

Family

  • stealc

rc4.plain

Targets

    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/New-Setup.exe
    • Size 316KB
    • SHA256 111c56593668be63e1e0c79a2d33d9e2d49cdf0c5100663c72045bc6b76e9fe6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    stealcvidarstealerdiscoveryspyware

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Detects executables containing potential Windows Defender anti-emulation checks

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/flutter_desktop_sleep_plugin.dll
    • Size 91KB
    • SHA256 9600697c57da5a1411a227eb5fc135f20d0ea292f458290d15fb959c1f75537e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/flutter_windows.dll
    • Size 17.4MB
    • SHA256 a2916ec602bad9e0798019b96fcfe9d26b880c310402e913294c19bd700c429e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/msvcp140.dll
    • Size 564KB
    • SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/tray_manager_plugin.dll
    • Size 113KB
    • SHA256 9c7e0de576932c8b2149849c96f3493bcae215f6db5996dbaf5ae1788697e8f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/url_launcher_windows_plugin.dll
    • Size 92KB
    • SHA256 578323ec0b492e72987778af3811cd00b71171b1e84b92e720964543f8f3a183
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/vcruntime140.dll
    • Size 106KB
    • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/vcruntime140_1.dll
    • Size 48KB
    • SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/vcruntime140_app.dll
    • Size 21KB
    • SHA256 813a447192c4fa7d25d0716b769399546f8bf6b31269dd8ad47f9812008d79e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17behavioral18
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/windows_single_instance_plugin.dll
    • Size 82KB
    • SHA256 f1430479210c19093d76435e5826e3578420933248b51164e11f0992f77ed1f1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/HDHelper_[0MB]_[1].exe
    • Size 566KB
    • SHA256 72ece91f65a461c5023695bf5f31b5b6b5bd629dba8407524e8144f6d1e160e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/NvStereoUtilityOGL_[1MB]_[1].exe
    • Size 1.1MB
    • SHA256 c2c71318a17f7f767e5d203d22b48f27eecae46a4f37082d7b413c51da6183b3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral23behavioral24
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/VSLauncher_[0MB]_[1].exe
    • Size 281KB
    • SHA256 87048cff2227d2901314760618d23917cfbc5cc15fc22dc355e803c5ee5fb211
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-processthreads-l1-1-1.dll
    • Size 17KB
    • SHA256 e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-profile-l1-1-0.dll
    • Size 16KB
    • SHA256 d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    • Size 17KB
    • SHA256 d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-string-l1-1-0.dll
    • Size 17KB
    • SHA256 3807db7acf1b40c797e4d4c14a12c3806346ae56b25e205e600be3e635c18d4f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral30
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-synch-l1-1-0.dll
    • Size 19KB
    • SHA256 8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      #)#NEw_SetUp_33778_P@$$Key#(#/x86/api-ms-win-core-synch-l1-2-0.dll
    • Size 17KB
    • SHA256 9ac63682e03d55a5d18405d336634af080dd0003b565d12a39d6d71aaa989f48
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
1/10

behavioral1

stealcvidarstealer
Score
10/10

behavioral2

stealcvidardiscoveryspywarestealer
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
3/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10