File name:	libcares-2.dll
Full analysis:	https://app.any.run/tasks/a50666f2-5b39-45a9-a995-de5c5eb28e21
Verdict:	Malicious activity
Threats:	Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Vidar is a dangerous malware that steals information and cryptocurrency from infected users. It derives its name from the ancient Scandinavian god of Vengeance. This stealer has been terrorizing the internet since 2018. Malware Trends Tracker >>>
Analysis date:	April 20, 2025, 18:22:44
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	telegram stealer stealc vidar
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
MD5:	93FB1D866472E1280E4A93343DB3ED13
SHA1:	FCC4CBAB5F13BFBCAC6B7610309CA6C3BDBD58AC
SHA256:	089DA3C21BDD12618E7D5F757D1742A48DC961B367A8515703C94D9FEBC965C9
SSDEEP:	98304:iTKyPfbyQ9Pfz1GYydMAfGDye3UtNU1RG2y7XdNd7QL/eERujxMVOqpeqqAdlrVm:Yf

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

MachineType:	AMD AMD64
TimeStamp:	2025:04:20 13:09:48+00:00
ImageFileCharacteristics:	Executable, Large address aware, DLL
PEType:	PE32+
LinkerVersion:	14.41
CodeSize:	2498560
InitializedDataSize:	3094528
UninitializedDataSize:	-
EntryPoint:	0x25cd60
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	209.198.4567.7890
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Dynamic link library
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	Bilboko Datu Kudeatzailea – datuen integrazio eta analisi adimendunerako soluzio aurreratua
CompanyName:	Euskal Teknologia Soluzioak
FileDescription:	Iruñea
FileVersion:	209.198.4567.7890
InternalName:	Iruñea.dll
LegalCopyright:
OriginalFileName:	Iruñea.dll
ProductName:	Bilboko Datu Kudeatzailea
ProductVersion:	1.0.0
AssemblyVersion:	209.198.4567.7890


(PID) Process:	(7492) ServiceModelReg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7492) ServiceModelReg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7492) ServiceModelReg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(7672) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(7672) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(7672) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(7672) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(7672) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(7320) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(7320) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2

PID	Process	Filename		Type
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1103c6.TMP		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1103c6.TMP		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1103c6.TMP		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1103d5.TMP		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1103d5.TMP		—
		MD5:—	SHA256:—
7672	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old		—
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
300	RUXIMICS.exe	GET	200	23.48.23.143:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
300	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	116.202.5.148:443	https://qr.ap.4t.com/	unknown	—	—	—
—	—	GET	304	142.250.185.195:443	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg	unknown	—	—	—
—	—	GET	200	172.217.18.4:443	https://www.google.com/async/newtab_promos	unknown	—	—	—
—	—	GET	200	142.250.185.78:443	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0	unknown	—	—	—
—	—	GET	200	149.154.167.99:443	https://t.me/v00rd	unknown	html	12.0 Kb	whitelisted
—	—	OPTIONS	200	142.250.185.78:443	https://play.google.com/log?format=json&hasfast=true	unknown	—	—	—
—	—	POST	200	116.202.5.148:443	https://qr.ap.4t.com/	unknown	text	58 b	unknown
—	—	POST	200	116.202.5.148:443	https://qr.ap.4t.com/	unknown	text	2.13 Kb	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
300	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	192.168.100.255:137	—	—	—	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3216	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
7492	ServiceModelReg.exe	149.154.167.99:443	t.me	Telegram Messenger Inc	GB	whitelisted
300	RUXIMICS.exe	23.48.23.143:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
300	RUXIMICS.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
7492	ServiceModelReg.exe	116.202.5.148:443	qr.ap.4t.com	Hetzner Online GmbH	DE	unknown
7908	chrome.exe	172.217.18.3:443	clientservices.googleapis.com	GOOGLE	US	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
google.com	142.250.185.78	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
t.me	149.154.167.99	whitelisted
crl.microsoft.com	23.48.23.143 23.48.23.156 23.48.23.166 23.48.23.147	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
qr.ap.4t.com	116.202.5.148	malicious
clientservices.googleapis.com	172.217.18.3	whitelisted
accounts.google.com	108.177.15.84	whitelisted
www.google.com	172.217.18.4	whitelisted

PID	Process	Class	Message
7492	ServiceModelReg.exe	Misc activity	ET INFO Observed Telegram Domain (t .me in TLS SNI)
—	—	A Network Trojan was detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump

General Info

libcares-2.dll

93FB1D866472E1280E4A93343DB3ED13

FCC4CBAB5F13BFBCAC6B7610309CA6C3BDBD58AC

089DA3C21BDD12618E7D5F757D1742A48DC961B367A8515703C94D9FEBC965C9

98304:iTKyPfbyQ9Pfz1GYydMAfGDye3UtNU1RG2y7XdNd7QL/eERujxMVOqpeqqAdlrVm:Yf

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

VIDAR mutex has been found

Actions looks like stealing of personal data

VIDAR has been detected (YARA)

Steals credentials from Web Browsers

SUSPICIOUS

Process communicates with Telegram (possibly using it as an attacker's C2 server)

Reads security settings of Internet Explorer

Searches for installed software

There is functionality for taking screenshot (YARA)

Multiple wallet extension IDs have been found

INFO

Creates files or folders in the user directory

Creates files in the program directory

Checks supported languages

Reads the computer name

Attempting to use instant messaging service

Checks proxy server information

Reads the machine GUID from the registry

Reads Environment values

Reads CPU info

Reads product name

Reads the software policy settings

Application launched itself

Malware configuration

Vidar

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings