File name:	2025-03-24_aba7ef1ba2fe7a2f5892a2dfbbdc0488_frostygoop_poet-rat_sliver_snatch
Full analysis:	https://app.any.run/tasks/34f4372b-1ce8-4138-aa2e-aa8ede206825
Verdict:	Malicious activity
Threats:	Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Vidar is a dangerous malware that steals information and cryptocurrency from infected users. It derives its name from the ancient Scandinavian god of Vengeance. This stealer has been terrorizing the internet since 2018. Malware Trends Tracker >>>
Analysis date:	March 24, 2025, 17:37:39
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	inno installer crypto-regex golang telegram vidar stealer stealc
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:	ABA7EF1BA2FE7A2F5892A2DFBBDC0488
SHA1:	1959D5388DDDBBAC923D97C0B1C766BB381BB1D2
SHA256:	BC6B1C4ED290D442C136D87536C39A78AE4DC49451198F2FDF6D2AD1B11A425D
SSDEEP:	49152:UA5ZOZFmaas8dAh8xVk28sT+Tz7lT9H4XpHOHFcjLdyx7PdmYyskat0rKycyWSJi:88WS9TjdgmzfJRi

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	0000:00:00 00:00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	3
CodeSize:	2434048
InitializedDataSize:	305152
UninitializedDataSize:	-
EntryPoint:	0x69270
OSVersion:	6.1
ImageVersion:	1
SubsystemVersion:	6.1
Subsystem:	Windows GUI
FileVersionNumber:	25.3.1.0
ProductVersionNumber:	25.3.1.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	This installation was built with Inno Setup.
CompanyName:	WinTools Software Engineering, Ltd.
FileDescription:	XtraTools Professional
FileVersion:	25.3.1
LegalCopyright:
ProductName:	XtraTools Professional
ProductVersion:	25.3.1


(PID) Process:	(7880) BitLockerToGo.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7880) BitLockerToGo.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7880) BitLockerToGo.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(8044) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(8044) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(8044) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(8044) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(8044) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(5048) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(5048) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2

PID	Process	Filename		Type
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF11cc94.TMP		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF11cc94.TMP		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF11cc94.TMP		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF11cca4.TMP		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF11cca4.TMP		—
		MD5:—	SHA256:—
8044	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF11cc94.TMP		—
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	—	—	—
—	—	GET	—	142.250.185.100:443	https://www.google.com/async/ddljson?async=ntp:2	unknown	—	—	—
—	—	GET	200	142.250.185.227:443	https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=122	unknown	compressed	95.4 Kb	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	58 b	—
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	2 b	malicious
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	108 b	malicious
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	5.69 Kb	malicious
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	2 b	malicious
—	—	POST	200	167.235.59.196:443	https://x.p.formaxprime.co.uk/	unknown	text	2.13 Kb	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7880	BitLockerToGo.exe	149.154.167.99:443	t.me	Telegram Messenger Inc	GB	whitelisted
7880	BitLockerToGo.exe	167.235.59.196:443	x.p.formaxprime.co.uk	Hetzner Online GmbH	DE	unknown
7312	slui.exe	20.83.72.98:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
1912	chrome.exe	142.250.185.227:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
8044	chrome.exe	239.255.255.250:1900	—	—	—	whitelisted
1912	chrome.exe	142.250.110.84:443	accounts.google.com	GOOGLE	US	whitelisted
1912	chrome.exe	142.250.185.100:443	www.google.com	GOOGLE	US	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
google.com	142.250.185.238	whitelisted
t.me	149.154.167.99	whitelisted
x.p.formaxprime.co.uk	167.235.59.196	malicious
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
clientservices.googleapis.com	142.250.185.227	whitelisted
accounts.google.com	142.250.110.84	whitelisted
www.google.com	142.250.185.100	whitelisted
www.gstatic.com	142.250.185.67	whitelisted
update.googleapis.com	142.250.181.227	whitelisted

PID	Process	Class	Message
7880	BitLockerToGo.exe	Misc activity	ET INFO Observed Telegram Domain (t .me in TLS SNI)
—	—	A Network Trojan was detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Base64 Encoded SQLite Dump

General Info

2025-03-24_aba7ef1ba2fe7a2f5892a2dfbbdc0488_frostygoop_poet-rat_sliver_snatch

ABA7EF1BA2FE7A2F5892A2DFBBDC0488

1959D5388DDDBBAC923D97C0B1C766BB381BB1D2

BC6B1C4ED290D442C136D87536C39A78AE4DC49451198F2FDF6D2AD1B11A425D

49152:UA5ZOZFmaas8dAh8xVk28sT+Tz7lT9H4XpHOHFcjLdyx7PdmYyskat0rKycyWSJi:88WS9TjdgmzfJRi

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

Steals credentials from Web Browsers

VIDAR mutex has been found

VIDAR has been detected (YARA)

SUSPICIOUS

There is functionality for communication over UDP network (YARA)

Found regular expressions for crypto-addresses (YARA)

Searches for installed software

Process communicates with Telegram (possibly using it as an attacker's C2 server)

There is functionality for taking screenshot (YARA)

Reads security settings of Internet Explorer

INFO

Checks supported languages

Detects InnoSetup installer (YARA)

Application based on Golang

Detects GO elliptic curve encryption (YARA)

Creates files in the program directory

Reads the machine GUID from the registry

Reads product name

Reads the software policy settings

Reads the computer name

Checks proxy server information

Creates files or folders in the user directory

Reads CPU info

Reads Environment values

Application launched itself

Malware configuration

Vidar

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings