General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
-
stealc
Botnet
-
1
C2
-
http://138.226.237.196
Attributes
-
url_path
/36e945441b634ecc.php
rc4.plain
rc4.plain
Targets
-
Detects Vidar Stealer
Stealc family
Vidar family
Executes dropped EXE
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext