remus_stealer | 0b84cb7608917a71c43e9bbd81332915239496aa23c078743dcd426bf5a5e337

Sharing

General

Target
Anvil Setup.rar
Size 106.3MB
Sample260831-qmrcbssfra
SHA256 0b84cb7608917a71c43e9bbd81332915239496aa23c078743dcd426bf5a5e337
MD5 25e865319764b59722c9556942a9d35c
SHA1 39393d9b816b6fd92878d56f0d5a371e364e151d
SHA512 fdb940a2dc26488fcf81a438fc11f6dc00ac12928770db133a7480ed63df02586510610cdc676afa12012e8c96e50a39f39fafafe86e592cc72315d0d15b699b
SSDEEP 3145728:izc+JaekCy+wpNHB9l2RoEXV963v+EUDlkWR3:oc+JdkV1h9PQV98+rDlrR3
TLSH
T102383391A597FDF7F040772802D5BBBE7D45FAC212270C860BDC69A9264D693C02E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

17.5

Botnet

b7b2d3ecf144064946d29df92ef56336

https://65.109.240.131
https://telegram.me/v11kng
https://steamcommunity.com/profiles/76561198748625465

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0

Extracted

Family

vidar

Version

18.7

Botnet

c75ab90afd4c98848f1291ee6da8315a

https://151.247.22.246
https://telegram.me/g1n3sss
https://steamcommunity.com/profiles/76561198721263282

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Extracted

Family

vidar

Version

18.6

Botnet

bf92bdaa297d6afd5da12398ade13c8c

https://telegram.me/t22see
https://steamcommunity.com/profiles/76561198727080522

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Extracted

Family

remus_stealer

http://flreaow.click:6527/documents
http://shhsift.click:7647/tasks
http://vexdico.shop:8539/collections

Targets

- Target
  Anvil Setup/Anvil Setup/Anvil Setup.exe
- Size 5.8MB
- SHA256 ad8fb8f3d1aafb1d387114aafeaaf5a5e80bcb83c186a282ded414588a332c58
- MD5 b3f8780613de3500e75bc09ce3668a64
- SHA1 75cb194ccd88be8705ffcd9886d721d0004b6934
- SHA512 6f9c7ac1f387e30a704696a50243e544cdd85e28f0428de708eef89deda7b3bf4488d7336c55ea458ca25e1b0eae52e7b5212df168382bf6a2b866219e24538a
- SSDEEP 49152:syKPkdaimaBC/MS+E4KEtXRoYa0mCa2ZcYRiQY6ml5TzQqZPMmMT5SAoFI8BcFwE:sdv0YcbPlcldMWZciE
- TLSH
  T14D567D077B8181A0C056EA7AC4B742557B787C1D833033BB6EA6A9702F363D1767AF64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Anvil Setup/Anvil Setup/CoreMessaging.dll
- Size 2.7MB
- SHA256 105756a1242d4378f89a75c849dcc3ba22c79b6fa6d60935639423c07b3e31f2
- MD5 6d405d6e3d5d991090646e92793a4da6
- SHA1 e7cec9f2da9fe9a024483e427ae609a1705174e6
- SHA512 8a0d137200dcdd258409098e729b47291f7e0e297961544645a8c9f0dede7bb458aa0ccdff633d704b0762505ee9d8c9e5f493d586ea4dbcaed909a0066282d4
- SSDEEP 49152:AxqP9jPq+3FzzKTMvCVFLs0EYlK3dOUOv/TCXRD:H9GBFo/Yln9jC
- TLSH
  T19AD5AD05E3E40EA5D52BE674CAA79733D670B9411334C68F11A9DA0E2F73B914E7B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

b7b2d3ecf144064946d29df92ef56336 vidar stealer
- Detects Vidar Stealer
  stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext
behavioral2
- Target
  Anvil Setup/Anvil Setup/Qt5Xml.dll
- Size 161KB
- SHA256 404754c04e4fb75143bde0fc044af7b937d6b5eb29fe086116c7148bbb2dcf9b
- MD5 9539a8f0ace81f34d9ccb1a4b64ef68d
- SHA1 d1698ae3fcfca67545abf345db51ce31f49ad7df
- SHA512 4a7280575baa7412aac572b0e6fd0d0afb15ae302876115d3d19df08fa9a1b9b31e64e9a59cfdda9217f1328c5c0dd23235593167f13abe17bba832687e5f27e
- SSDEEP 3072:rPQGyA+YMu5maJXQN7u5hm10q2mpVg2RsUAvMEJ/tLYnI1RW2bxF:rQGyAdMugYXQNmq0qVpVg2CJ/tLcI1RV
- TLSH
  T12BF318F372658D72F04286745C5E7E2BEE7FB41C032106E3DF0AAC7709246D12A3666A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Anvil Setup/Anvil Setup/VCRUNTIME140.dll
- Size 83KB
- SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
- MD5 1453290db80241683288f33e6dd5e80e
- SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
- SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
- SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
- TLSH
  T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Anvil Setup/Anvil Setup/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH
  T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Anvil Setup/Anvil Setup/cmutil.dll
- Size 1.0MB
- SHA256 c1b25e91dbf905f6562049d47d6344d0aa4caee43672d7a0534cb32d71a74848
- MD5 e00121ebed3b92365840d70f048365e2
- SHA1 b5f640b4c5cd2dcc9f4861405dba71245e827654
- SHA512 c57b5929359e7607afe00532d4b8e63e4940f1f5a3e27d72b13c1a5ddee85cefe644d5d7f2e0357fb6e7d43b098b5394f3e1f58ecdd3e3458d70fdccdc4c3cf9
- SSDEEP 24576:2LFU1plxNK1jrYlP4lRBwF0jlOXegLQQuz53SbCJJBmn/ymnmhHGvgGszmeQPAPu:k8sj
- TLSH
  T175358E3ABF9F49EED81CF27D4082D0D7CAE09A1C629845DE5BE0311BDC79DB219B8146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

c75ab90afd4c98848f1291ee6da8315a vidar stealer
- Detects Vidar Stealer
  stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral6
- Target
  Anvil Setup/Anvil Setup/jli.dll
- Size 2.5MB
- SHA256 d6a33c719a8cdc64fdc544619e371044a96c0afc27150c210d0a4620d8b48d16
- MD5 b438712a6a9e290f8f9e0d0616503447
- SHA1 154a321fc5d16f0559c494142a01e8b7f056ae71
- SHA512 0da6a204e77273d8b3a4b72c221dd0bc885cb6ca58d56e418eaf2b4cb46d0c1396af9093d49f8b0dce92b0115ad701a69f3658707e063709eaf06f77f44994e7
- SSDEEP 24576:cjTwrlzh9kUJRuRu3ARMrh1I42ZtoyOzA9UYHiLYDCTwGsFhele5n92VOLHK8so:cjghheYRuk3Aur3ITtnpC+DCwEABso
- TLSH
  T102C58D06BCE048BAD06693368DB722927B35F8480B3633D71E5366792FF67D06978784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bf92bdaa297d6afd5da12398ade13c8c vidar stealer
- Detects Vidar Stealer
  stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral7
- Target
  Anvil Setup/Anvil Setup/mpclient.dll
- Size 3.0MB
- SHA256 e10d1d86a15a3feace6f283ea4b4f6798cfae9ed09f3c3d52e6e73be0a8f9541
- MD5 8dd4e8567186730b6ed681d2947d338d
- SHA1 40e4c92649d6ed0fa21af0ecb7b9a19c0c10bada
- SHA512 c57914532c290271e82f59b07fa0ecf0a7594088aced92e911f1e32b700542a46680ddaa298926e776ccdb9b58d8ffc996e7a39af35d2264386fd7d68d25bff6
- SSDEEP 49152:70E8+M9A+IdYFj+Er744NeuMD1gIKXzFrAgBRFy5VLq:TMH344NedKhrbWVLq
- TLSH
  T1C6E54A03BB90D1A1D8A7D23865B997507B34B81ED33633D72E2476B42E357E06EB8724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery remus_stealer spyware stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral8
- Target
  Anvil Setup/Anvil Setup/renderer.dll
- Size 793KB
- SHA256 c9c24078a05aa0363aa9f1920be90ceb6aaf518246afa2a08894dec3621d8e5c
- MD5 ceeda36fc77e4249ad13ca12d396dcb5
- SHA1 7b30dd216eba8aae1db1c164b938c7f059ed5a73
- SHA512 ba0d95d89fee391e4ca02338210cc700cb06f67b0d018a49b574b73327b5e2eee9e4785d8964cf51239ce36bd4b6e2e177d71ca1b508dc9b2cfe1d9eadcb78c2
- SSDEEP 12288:ycSY5KhukiO51flDoJWmuA00FFjxODB8y6Wyd4C+nA6DI/Y/:ycxA/5FBoJ1uA0gv28UydT+nAc8Y/
- TLSH
  T149050A702A09C53AF99D12F24D39AEBF406C9A850B7485C7E7D86B5FAE305C31B36907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Anvil Setup/Anvil Setup/resourcecompiler.dll
- Size 51.2MB
- SHA256 3251e20a53edcc0225dd30c386f2bf9c60a9c581267130c0dd108b7e0fc7a054
- MD5 ea0cff39dfd153ae118204c7fee91dfb
- SHA1 24127548d9a60d4f4de771468d080812dae6af9a
- SHA512 fbc77df75dd919c1b11e6795f3f122432348607974ac75a0584dbe6e58b74eeb5e4927663cbf69c2d9e48caeed60c880668c95d0e1a42dbc211c89dcc8cdd451
- SSDEEP 393216:9yiQ+eXxV196mc41OxDYObvbmYitFhTlVswOuCIbF3rR/SW8Q1A0JelmDSAjl2Pk:2gxDYObvb9itFGluCUMEO0HD+qt6w3
- TLSH
  T105C76C0BE19660D9C06EE234852B9D4BF2B234D64B7563DB15B1426DDF3B7E006BB3A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Anvil Setup/Anvil Setup/rsync.dll
- Size 98KB
- SHA256 4ce1b70954b0f36b0dabcfbec2fb3a3574c7bdcbe82909182faa264045fafad4
- MD5 ef7da6fedc4cc560fb432854d5f79c07
- SHA1 b3cc2d98dd83065e404f1b18a0606828a5673c7c
- SHA512 6231f8d5288d94ac6787b2f1c6507ea084f2d533f7e50629bfe6508feb106a2690ce6204ba95ab2c35a5af89ccffeb04a7ff0c6381a13177c30f8c7e115da5bf
- SSDEEP 1536:WOAdY9kIs7mQ8Pc0n+KYovjDf5k6CUfyP5Sht:WPY5PJNqP5a
- TLSH
  T1A0A31A3BBA80892BFE96457EB36C5B67472457308B9AC4EB9B0504CE64774E26334F07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Anvil Setup/Anvil Setup/sdkencryptedappticket.dll
- Size 621KB
- SHA256 bc2caf9fc5f60241e3e212a3d77830f5a505acfa4e801c6079123b06610231dd
- MD5 633344371ca6b30a459b889c81b99f98
- SHA1 ffa238a03ba53e23e5ec0ee755fdc3c4da9a70a6
- SHA512 60a312d002002a4ce1b64eb4d10bcd3f134314a8547926ff6b3f01e9481aaf5e6df42773c5a7d64e0e1cdb0b03521fd2acdb67039dbf3704434a2082cab77f75
- SSDEEP 12288:ob3UbFpkYhGggOhj50eKVDh3WMwsA25Sr9kbLxanlwj3dRN2vezsHx8Y:K3Ubfk7gVjwImbolwj3dRlsxn
- TLSH
  T149D48D317501C676F5AE02B1BD2CEA3F189C7A294B2448D7E3E86A2F5D780C31B36657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Core.dll
- Size 4.0MB
- SHA256 10dc044f64dc629db3fb91249b181b157cefc2274c6f971fd1de2633dce0dda1
- MD5 2a2ceabc8038e7918ccfd851efa4a147
- SHA1 fa955c867914af0a209811cffd60b06dea2fae02
- SHA512 e70c8bbdcc40cfb03c6124f3a555abfcd6e89e2a991d66786b170a039f2a0651ed405a31c2252b472121f32aabbdffad22e69457e009eb2f7a1cba05acf84181
- SSDEEP 98304:byzlVcrMkYWoFXbY1pJsv6tWKFdu9CLn0:bqOMkYWhpJsv6tWKFdu9CI
- TLSH
  T155167CA26756C636FAD292728C6ED72F0035FD564B1285CBF38C361958706E23B3B14B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Gui.dll
- Size 3.5MB
- SHA256 e808387b4a915939b85ce6d761f68faf8f9382e9339e6f79c43eaf0798b09672
- MD5 dfa73837ff2a7b85afed31dd2ba2f684
- SHA1 dbfb74fd72f9065362a66cd0064eff409a406051
- SHA512 e6dcbd659513893648f8f84672ddd3ee5c8fc0bc1b8d5134da1083f3b1004e079f27adb34d8868483436ff88fd3a218905fc6438cf57f38e6d3494aa72632077
- SSDEEP 49152:RI1l3y9mrnMkrmZlWVB/FyvkpEpaj1r7rKUWnrdN3GA+MyY+3lbuJzzd9NgCxQeg:KmKB/FOw7dy3GAKb3
- TLSH
  T1FA069ED2FEA650B1C481D2B5551EAA7FC635A206471A82F7D3C8BD05E5303F23E7B289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Multimedia.dll
- Size 581KB
- SHA256 19774cab3c6e6ad24ff0ee53c107efa9e01fd4cfac42a7487fe4501ad22eec19
- MD5 94230d4f195485261818c1cd7dd44666
- SHA1 099d749ec531e2d5447143cac4567063f91ad852
- SHA512 07ab30bf3e2a4692be55daf0369d0027d753294750a2c0baafc23263cd77944951abf2e4d1d436c3d2bf53279afcef9f6a700ea88c1890e5973ca7e47f3af8a9
- SSDEEP 12288:B716pGY5PNSIlzcon9q6Pa59q9pWeWi9qE4Q9qazBy9qk2PgrkJFYn:BoGYZ4WPaAASgroFk
- TLSH
  T143C42931B29183B3E4D5D1B97D898A235972F0508B4287C3FB09FB5F6951BE26E3D281
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Network.dll
- Size 816KB
- SHA256 75b82e6048f5c3064ff725c945ade59d251141f2f863c9427c1e57c2ab5811b0
- MD5 a7982798d0f670bce11f99fed5dee9f1
- SHA1 40b9df5eb94e398b997f2604244c498187829e14
- SHA512 27fa69995c5a3a34c843bdd21e9be2e6c7c89ee5043d6da53d4b7d49a43265b9bf68318e738af2427444cc2cc97db4e7d256280f8aa5d936aeb470d60b2cf8f9
- SSDEEP 12288:Mtm4ozAuC0HzAjN9RqsH64II5MIxfetFFope9oXtCc5P9gN:Mtm4ozAL0HzAjwcwI5MGfetAe9o9Cc5S
- TLSH
  T1C1054C92B78A01B3E98453B5461DAB27D63DF11E47711AC3A31CEE1A50933F2293F1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Anvil Setup/Anvil Setup/settings/Qt5OpenGL.dll
- Size 269KB
- SHA256 885a4134ae48d5e6fd57afd79c56d74d5d33f267b6d937bf84459f2b85bfed03
- MD5 79bf52eea529bf72652ed5e93c36c76e
- SHA1 028c5825af918f8fdba803534d4af7fd2e923db2
- SHA512 bc1d5d5feb3c5f93ca5ccfd30679229f11e146ccd0812ab1553de1554100a99da50c911d71b30b9154d91fc94efad445e2a509432dd187ccb11ee4d8951c424a
- SSDEEP 6144:ZLZ2Rx8CNhdiDlFmFuz8+o4Z9UGZA+IDlJl0XlT1cr70ia7mHxJeXHpJlzEWrC24:WRx8SWlMFuz8aZ9FoH
- TLSH
  T1A5443A53755669B6C887E375099F5F2B9239E0128320C2C7B28CD7095BA17F12EB738E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Anvil Setup/Anvil Setup/settings/Qt5PrintSupport.dll
- Size 272KB
- SHA256 ee02d72b4dbe93f2fbc48b89d53f9b85e45a3d89d1fe8a9f6426dae6b5a0c972
- MD5 7eb068647180c42ff167d6240270479b
- SHA1 06d38dea13b2a96313ee9c69ea878a9c9841000a
- SHA512 a29220159faa91fdad0d143b3025683dc0c0b97872e8562d05fe76ce5be39879089d0afee98c622de42bb633a08ccd0eb31b28c8c2395751f957b4bc062443bd
- SSDEEP 6144:qF6SSyojMni04Hfnn8Nu1shdNn0u3ZPy7hcD3I95HZbPSRyuoboXHcJ2ZWa3ItbW:qFSyoQifHfnn8Nu1Kom
- TLSH
  T1DC545CC367672ED1D5CAD27C190D4627C43BF13607F682CBA319EE0198513E26DBA36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Qml.dll
- Size 2.4MB
- SHA256 666691b09c703818812f314b444ca5a65299e32fa593b0069eca6d107115a4ed
- MD5 6fbc28c249cb61660ded4096e2410409
- SHA1 30777d01b18565bcb651da7f985f0cb7ab1438c3
- SHA512 e2def5779bd5294b9cc86d9d10b557b5722a2014a84f586732b00079bffc8a9c37b736c360a4f37883b00c80b0d008bc740f84ae86a9a0686fb4d298cf258605
- SSDEEP 49152:lh/cB6fvitoJrBcv7hiccwmxhCTIIritcwZI:rvitzv1RzuIQI
- TLSH
  T148C58E93B3C141BED482D2785D9E5A36CA36F1184325EBCFD38C698952F1AE11D3F289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Quick.dll
- Size 2.5MB
- SHA256 7f4f352aa1552dee1c89a0dc3c562a5d85ec1a263fbb79e3e85ee7032b5bda3a
- MD5 2847129aed54501c45077434f33e0184
- SHA1 5b20543d7876d36f238f9e8aab2d02b9d1e474fa
- SHA512 a90442cc088447b63e28c34a516a61e831d4725068bddd2077d3cf6b6ca44bd2b751c99f0f2d50c8a69b7f1bc1be300ffa569e68e5424091489f001ec9e306ac
- SSDEEP 49152:DouCPCN/dn5h5EcuYXa2KBv9fLgcuiTgmmtPrEZUd/:BCoXQZ9fkgxY/
- TLSH
  T1E1C58D51B1C291B2C4C5A3BC28CE9723863AB084472AA5C7F395AF5D91716F11EBF3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Svg.dll
- Size 261KB
- SHA256 dce1acd44a4e6942ce4651f04efefaaf6fb29b3a383fafca0a1e8583a5583e55
- MD5 f203b31a2f9d2a02f80aba25581e87e4
- SHA1 f7ae541ebb13557dc046f1f4cca7061da369869c
- SHA512 c9f1d532bc3c3c4612bfcae718321bc28879b614bf115d254e5dab2be7e93151106bec1d5417606ea1f9a545bc1bd94b9c8d5b21335f5ae1ac937ef5bbc60279
- SSDEEP 6144:zMzQPpRyJBSHGYraZHMbdxQ4zFgpFRr6WGcy8DvfUyA2oJ2eX4dTEVACJW5Vhf+N:zMW2SNadMJXFgrFjxmz
- TLSH
  T1D1445C63B3464EA1D08ED278685F1697DD3AB44A03BD87EB93AC9D30C4683F45DBA341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  Anvil Setup/Anvil Setup/settings/Qt5Widgets.dll
- Size 4.2MB
- SHA256 200f8fa3c984b2ed51500e029889a550d88e7ecb3b2e3851a3e4cad261540061
- MD5 eca52f653ca979bf7628e00c362db1fd
- SHA1 c92c3077e30d492e461e03e412cf53d2c7aabd8f
- SHA512 663d3811bcd059088b10f931de894f12d5262e7249e061717cd1619bfa567e7f10cfa0de87d9ae2a100bc12e63c5936bdfa1f5ba50c50baedbc2992dc13056f5
- SSDEEP 49152:KUeb2rJ9g/n0PHLJvqJEWUf0nB191j150HkC+qLCauk72iR/:oyzPtSJznBncp+ix
- TLSH
  T14B269F93B38241B1CB87D175095EDB67C576B119CB1657C3A388EEC268903E12EBF386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  Anvil Setup/Anvil Setup/settings/cef.pak
- Size 1.9MB
- SHA256 c1905d10412b9bddc75e080f993ee99fa8d23d500b559bc398a25c6da3a7352f
- MD5 eecf468fe8bbd3c429e2054afac3e21f
- SHA1 915dc05dbaddb0ed73c3907f8576b9699a8e27a3
- SHA512 cb2be8be0a4cf0972cd90c274bf1d0f9b26736f55e612340668fa7cf897d67f62b2f71b056b4cd77b9c88f5ef6deb950ba1445f3c547106b7557863f0325abd0
- SSDEEP 49152:jTR6BFy4e3xlUKRbv2vCOBYveEyjD8d16PT:qFDehlUKRbevCOyvujkcL
- TLSH
  T117952310E9D56E26D7F6E379B86562636D39448358A0BC0CF4CF420ECBBC55A11B933D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  Anvil Setup/Anvil Setup/settings/cef_100_percent.pak
- Size 262KB
- SHA256 80c5945419567a473409911fcc3838913067e389b7eb7999f6e7a52d9192023c
- MD5 eb50b687fcaf0fe05df976ddcc45434d
- SHA1 0ef27d73ec281f6bf0e3076e54d05cfccf7d7d2a
- SHA512 4c29faa60e4acc246f58c3e257c8e6bb9eb5c7bc93579d3a6e25485b8ed2d6f378f76c4327527e3fa4711e3c80c4340c22de53d020be1a82781a58c6f6d3e001
- SSDEEP 6144:cNk7S+yq1H1yFepjbzwVyTqJeyx5c1YC7x10fSucY7OP2ITQ:cNcXjxgjgf1d/dQ
- TLSH
  T19144F1E3F3B4AC7ED69B0A3361510673D97B823A1653030AC24689767E4AB80EDDD747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  Anvil Setup/Anvil Setup/settings/cef_200_percent.pak
- Size 413KB
- SHA256 a2cd6a92494a148e3aa8b3c3bbba388b9b9351fea518f545ecad48478d40f599
- MD5 2a394cca70b075985174cf3a5b8d42b8
- SHA1 2390206075a8e733d19a99a5d6be055ba21035dd
- SHA512 7f5ee7e16bab1f2ef4b44f61547c4397b6d7759570246022bee5b010fc7b1fb136a946c10e14e30efbcd0c13aecd89f0e2b13eafd9aecbc34e5460538667233c
- SSDEEP 6144:pk7S+yq1H1yFepjpDQYaR+9bGHgs4jTlrJeWz73QYV85u/oFYvwoytKi6obByPG8:pcXjGfIegs4jTLLg5u/oFFpxLlFYb
- TLSH
  T12B94F2E6F3F8AC39D9930E33525109B3DD77653506A7030AC18A9C357E4AB9489CE39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  Anvil Setup/Anvil Setup/settings/dx12user.settings
- Size 6KB
- SHA256 514395c31a4591b0dc85aac048c079d90620abadcf768bfd255e10190bcb92f6
- MD5 3635632d49c0b3c6a2f805e0cd64670e
- SHA1 1c0b36ecc0326a3807f7a91ed274451cbec18ce7
- SHA512 3a1428c7d3dff3c292caffb727f48ed553eb3e2a3724731f3eac6e7dba20ae60790c20d00ab7cd7568967fda8a46eb3c152610312c6f05feb714311c5b215648
- SSDEEP 192:K6uV8NXlf96S677KeXx8igzaIhe6E+a/kbLUWoApzec2cfBq2fIx/CGy+2l72HlF:K6NctBhgzaIhe6E+a/kbLUWoApSc2Kd6
- TLSH
  T179D15491DA593A7C2C97E07CDCD2768306932F85B0ABA8F4B34518AD7F44C601AD9D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  Anvil Setup/Anvil Setup/settings/dx12user.settings.bak
- Size 5KB
- SHA256 3be39694d0b1d90ab350c461a6b4457f0f2faacaee61774e671000144f690cb7
- MD5 23daaa20f1b560b2e90be16f70ca3da2
- SHA1 5dfe9246a5b735b40da07dd75e62d6d76f1b2608
- SHA512 82088290dd19d74a00625048b912ef36e69b81d3daf8cb3e90415d777d6fc1e4e15b5904bfb7cbd96f230fd74b5c0af2ff6b3b8505c46208e04d09c84e2d7796
- SSDEEP 96:FN6uV8NXlK196S67g6KeXxh6igzaIhe6E+a/kbLUWodupzec2LF12FEb/Xq7q2fM:76uV8NXlc96S677KeXx8igzaIhe6E+aJ
- TLSH
  T1C0C144519A5A797C2C87E078CCE2768702932E86B0ABA4F4B34419AD7F44C602AD9D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  Anvil Setup/Anvil Setup/settings/icudtl.dat
- Size 10.0MB
- SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
- MD5 bc7064ba87454ff6ae541132d6678c94
- SHA1 ad0f0a5c7aa60e113706971f10b523c57e5ef075
- SHA512 6899cb7ec0595e938f9efd6798b5646f5e4ca18ab257b57b8995e1dd2d152c1f7d355222ccf66e9a445997672f877cb0d137598020a0fd75b45743058dcb5445
- SSDEEP 196608:a+wSv9AAQQ5EliXUxR0rHf93WhlA6tv1r:OKlQQuliXUxR0rHf93WhlA6tv1r
- TLSH
  T154B61742B2EB4DC1F9FBAE71D9F463639526BC05AE31815906042F3B5C773E08761BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  Anvil Setup/Anvil Setup/settings/input.settings
- Size 88KB
- SHA256 813dc740fabe35bf5983e550795e9bfa40b888f0b44b16a4da1c841d2e3dd829
- MD5 74061757bd00a6d226a397e5d78fe563
- SHA1 22afc0173308d7cbe8c6d9018a8edeeaec9d1f11
- SHA512 94cfe4046a40a973483a933f7208027c77d663bd9f26f56d97bd71737630f4dacc974feadde7c1281dffe065618185a8eae4d1084660bf0ab1867ecc06f91d94
- SSDEEP 768:YOSy9FYMHg/aqTuIFJ+IWga+Fs8aaxGpFSDYr+Q8vNSD7DlbQbLma+Fsr4rp:x
- TLSH
  T1EE93DD953054F002ED0F2AA751E726D1F43E215F203859A691D0BE8B0FFB36995AB37E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  Anvil Setup/Anvil Setup/settings/lgc_res.dat
- Size 2.4MB
- SHA256 791c7596faa04efa9ac04de78f98555125f771d724e7ed4d781bbeca084e4dd9
- MD5 aa00b5b023cf79b9fb12d5971b6e7052
- SHA1 ad9dbf4cdf07ef84c2efaa194369d420b5c36071
- SHA512 a6505563ae979aff666122699fcb373a35dec37a3c6c7354cc6e40f742291706b2fe640c86d6af66e42a34e8c9805fbfff747b19dd7a0e2c5d34019f7bb95802
- SSDEEP 49152:GZ/SQHVGQ8/giMVWMyPl4u/oOZlvDRBVepcgUUQag9yaA8J9I7j8Ct:+/DHEj/JMVWMyPSIoOZdVScgTBbP4I7v
- TLSH
  T105C533E7FA93CB1AD65B0B3115AF59536E730ED565C4408290C7BD2B8C34BF89C83266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  Anvil Setup/Anvil Setup/settings/profile.settings
- Size 102B
- SHA256 a095c83dfcd9371e7aaee0561357199eaefd8b65111b694aa940d84ef42bd508
- MD5 fca8f5239fc34cdec1b818187c45677e
- SHA1 90928f3d1cca0586c1521e342deed9f0e66632c9
- SHA512 ec212239d71e8c5623bb3acc97aea09831d7bc668c526504c046bb38d90988a3a0789d50cf0a11d9f415f4cbc9f5ca29e4be6dbc2bcb8d95c95b18e52b4cd9c3
- TLSH
  T1A0B0126F40A37467926D52720556C245D50587345418593CCEE362935182A0B256D300
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31
- Target
  Anvil Setup/Anvil Setup/settings/ui.dat
- Size 17.4MB
- SHA256 66045212110bd3d2f9939c0c3f009a1743701417ca2219035cc0b7780afb98a7
- MD5 2b80ed0e86a0d479a5b06091fdb60507
- SHA1 ab1ae818a58b521e5186f0dbb14e1eb93cc6a790
- SHA512 121fa55c64eb8e878af04af69435c89b1870d58c2decec6fc49e0a0df732d977995255d0b53aef0cecdc718a53346323221f230657d175614d14b85df0d9ba25
- SSDEEP 196608:pfZURJ5D5VTHqEIn/wfqBLGiLocoF3eMDxB05:paRJx7THKneiLocoFhDH05
- TLSH
  T1CB077DF43298D2E08647DFB4DC361962D63E2CF8AFC882C8B26CD8D497661D9CD89C55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Detects Vidar Stealer

Family: Vidar

Badlisted process makes network request

Suspicious use of SetThreadContext

Detects Vidar Stealer

Family: Vidar

Badlisted process makes network request

Detects Vidar Stealer

Family: Vidar

Badlisted process makes network request

Family: Remus

Badlisted process makes network request

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32