Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a54a0c0c59749ca2d7759f2911ff5e3eddd8dc70462d0ab2b7fff14733e4ae3

  • Size

    5.0MB

  • Sample

    240617-frlyaszcqk

  • MD5

    eb1825f67fa812d4cf489c0a91d6abb1

  • SHA1

    0e184078748e2fc476d58ff885a928ce06edf532

  • SHA256

    6a54a0c0c59749ca2d7759f2911ff5e3eddd8dc70462d0ab2b7fff14733e4ae3

  • SHA512

    392b933fb93a4ac4752b9dd641000e160c80c2a3fc36bf17ce9d2b19536e82986926734d41cb040ad34d908e96339103d76280d9a29982cd89c699011824fce4

  • SSDEEP

    98304:3uvdhDO6vR6yCeRIjylH/2pVdQIxBXj57zxe:3yLDO6vR6yCeAwQ5Bt7zxe

Score
10/10
stealcvidarspywarestealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://t.me/memve4erin

https://steamcommunity.com/profiles/76561199699680841
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Targets

    • Target

      6a54a0c0c59749ca2d7759f2911ff5e3eddd8dc70462d0ab2b7fff14733e4ae3

    • Size

      5.0MB

    • MD5

      eb1825f67fa812d4cf489c0a91d6abb1

    • SHA1

      0e184078748e2fc476d58ff885a928ce06edf532

    • SHA256

      6a54a0c0c59749ca2d7759f2911ff5e3eddd8dc70462d0ab2b7fff14733e4ae3

    • SHA512

      392b933fb93a4ac4752b9dd641000e160c80c2a3fc36bf17ce9d2b19536e82986926734d41cb040ad34d908e96339103d76280d9a29982cd89c699011824fce4

    • SSDEEP

      98304:3uvdhDO6vR6yCeRIjylH/2pVdQIxBXj57zxe:3yLDO6vR6yCeAwQ5Bt7zxe

    Score
    10/10
    stealcvidarstealerspyware

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks