File name:	fir.exe
Full analysis:	https://app.any.run/tasks/286a4e26-7db0-4d1f-b15a-9991c372a24e
Verdict:	Malicious activity
Threats:	Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Vidar is a dangerous malware that steals information and cryptocurrency from infected users. It derives its name from the ancient Scandinavian god of Vengeance. This stealer has been terrorizing the internet since 2018. Malware Trends Tracker >>>
Analysis date:	April 29, 2025, 14:53:49
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	telegram stealer stealc vidar
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:	CF2529889606402259675B9CB23D8B56
SHA1:	4B3554B138BBFDD4ACC49BB00E641173034D2A6C
SHA256:	387E2FA2E5BF8C93AEF6C1BAB3EE0B3D95255D9422DDDE9B6331E8395D51A176
SSDEEP:	3072:WPVqwfAuqOUx9w3eqrDtu+rgNxQ6/oE7jxr6MMhMlRTMMHMdXuSYBMEM8MZMvMcx:WPVqwA7OUx9w3eqr5eD7SYKDNTnlUP

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2025:02:24 04:48:01+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14
CodeSize:	115200
InitializedDataSize:	24576
UninitializedDataSize:	-
EntryPoint:	0x17210
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI


(PID) Process:	(7784) fir.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7784) fir.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7784) fir.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(7896) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(7896) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(7896) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(7896) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(7896) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(7552) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:	write	Name:	{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value: 010000000000000031C8EB9916B9DB01
(PID) Process:	(7548) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:	write	Name:	{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value: 010000000000000031C8EB9916B9DB01

PID	Process	Filename		Type
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10ffed.TMP		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10fffd.TMP		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10fffd.TMP		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10fffd.TMP		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF11000d.TMP		—
		MD5:—	SHA256:—
7896	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	304	142.250.186.99:443	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg	unknown	—	—	—
—	—	GET	200	149.154.167.99:443	https://t.me/m00f3r	unknown	—	—	—
—	—	GET	200	5.75.209.111:443	https://66.44.4t.com/	unknown	—	—	—
—	—	OPTIONS	200	142.250.185.106:443	https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData	unknown	—	—	—
—	—	OPTIONS	200	142.250.185.206:443	https://play.google.com/log?format=json&hasfast=true	unknown	—	—	—
—	—	GET	200	142.250.185.110:443	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.F939Du45chc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8uI5v7Xlp-b-Z4Th_hAAVtm2lZOw/cb=gapi.loaded_0	unknown	—	—	—
—	—	GET	200	216.58.206.35:443	https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=122	unknown	compressed	95.8 Kb	whitelisted
—	—	GET	200	142.250.186.164:443	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	unknown	text	7.06 Kb	whitelisted
—	—	POST	200	5.75.209.111:443	https://66.44.4t.com/	unknown	text	2 b	malicious
—	—	POST	200	5.75.209.111:443	https://66.44.4t.com/	unknown	text	5.69 Kb	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7784	fir.exe	149.154.167.99:443	t.me	Telegram Messenger Inc	GB	whitelisted
7784	fir.exe	5.75.209.111:443	66.44.4t.com	Hetzner Online GmbH	DE	unknown
7896	chrome.exe	239.255.255.250:1900	—	—	—	whitelisted
8140	chrome.exe	172.217.18.3:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
8140	chrome.exe	74.125.133.84:443	accounts.google.com	GOOGLE	US	whitelisted
8140	chrome.exe	172.217.18.4:443	www.google.com	GOOGLE	US	whitelisted
8140	chrome.exe	142.250.186.163:443	www.gstatic.com	GOOGLE	US	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
google.com	142.250.185.110	whitelisted
t.me	149.154.167.99	whitelisted
66.44.4t.com	5.75.209.111	malicious
clientservices.googleapis.com	172.217.18.3	whitelisted
accounts.google.com	74.125.133.84	whitelisted
www.google.com	172.217.18.4	whitelisted
www.gstatic.com	142.250.186.163	whitelisted
ogads-pa.clients6.google.com	142.250.186.42	whitelisted
apis.google.com	216.58.206.78	whitelisted

PID	Process	Class	Message
7784	fir.exe	Misc activity	ET INFO Observed Telegram Domain (t .me in TLS SNI)
—	—	A Network Trojan was detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

General Info

fir.exe

CF2529889606402259675B9CB23D8B56

4B3554B138BBFDD4ACC49BB00E641173034D2A6C

387E2FA2E5BF8C93AEF6C1BAB3EE0B3D95255D9422DDDE9B6331E8395D51A176

3072:WPVqwfAuqOUx9w3eqrDtu+rgNxQ6/oE7jxr6MMhMlRTMMHMdXuSYBMEM8MZMvMcx:WPVqwA7OUx9w3eqr5eD7SYKDNTnlUP

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

VIDAR mutex has been found

Steals credentials from Web Browsers

VIDAR has been detected (YARA)

Actions looks like stealing of personal data

SUSPICIOUS

There is functionality for taking screenshot (YARA)

Process communicates with Telegram (possibly using it as an attacker's C2 server)

Multiple wallet extension IDs have been found

Reads security settings of Internet Explorer

Searches for installed software

INFO

Creates files in the program directory

Reads the computer name

Creates files or folders in the user directory

Checks supported languages

Attempting to use instant messaging service

Checks proxy server information

Reads the software policy settings

Reads the machine GUID from the registry

Reads CPU info

Application launched itself

Reads Environment values

Reads product name

Malware configuration

Vidar

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings