stealc | e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829 | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

General

Target

e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
Size

4.2MB
Sample

240617-fvryqazelj
MD5

8cfe70cf4f35c7f9b4ddba327d44c1f8
SHA1

4fd044d2fee22138668153a7472b34e0b9a99c06
SHA256

e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
SHA512

aec1486ae4e64e8ca59baaf7a623fc4c6b56a3b3bcb6e46cadf82350799edfc62ede7bdb54fcbce490c5506e39f1dc778be160c130edcb6784667a448dafc811
SSDEEP

49152:Yg0GkQNDv4gz+LzRdo/msRu92zAPZHPPumf7BQOyCEJ7eAPDbn5m0IcQgZV0Cego:yLNdo/TRuMyfPyCk7eIZIcQ0Ogo

Score

10^/10

stealc vidar spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe

Resource

win7-20240611-en

stealc vidar spyware stealer

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral2

Sample

e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe

Resource

win10-20240404-en

stealc vidar spyware stealer

windows10-1703-x64

11 signatures

300 seconds

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://t.me/memve4erin

https://steamcommunity.com/profiles/76561199699680841

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Targets

- Target
  
  e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
- Size
  
  4.2MB
- MD5
  
  8cfe70cf4f35c7f9b4ddba327d44c1f8
- SHA1
  
  4fd044d2fee22138668153a7472b34e0b9a99c06
- SHA256
  
  e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
- SHA512
  
  aec1486ae4e64e8ca59baaf7a623fc4c6b56a3b3bcb6e46cadf82350799edfc62ede7bdb54fcbce490c5506e39f1dc778be160c130edcb6784667a448dafc811
- SSDEEP
  
  49152:Yg0GkQNDv4gz+LzRdo/msRu92zAPZHPPumf7BQOyCEJ7eAPDbn5m0IcQgZV0Cego:yLNdo/TRuMyfPyCk7eIZIcQ0Ogo
Score

10^/10

stealc vidar spyware stealer
- Detect Vidar Stealer
  stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

stealcvidarspywarestealer

behavioral2

stealcvidarspywarestealer

© 2018-2024

Terms | Privacy