File name:

9d79fa9eb281db34a0bcbdb9b7025a9c.exe

Full analysis: https://app.any.run/tasks/333dac92-c789-4e60-910c-46fdc92d85fe
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Analysis date: March 24, 2025, 16:53:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
stealer
stealc
vidar
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

9D79FA9EB281DB34A0BCBDB9B7025A9C

SHA1:

1618E6C9AD3EEFEC3814DDCCCCF79CCE66E65C78

SHA256:

EE5E631FB44E9E3ABCEA9E0C4EE192475DF976D0A049375AEFD79A3513FA8F43

SSDEEP:

49152:Ll8ByHkyQAavX16zSRKxXtR45xrpIAiNTgmGbU3QecPX+/lrIFOhnmjfSoe1kEXC:LoyHwAaf16zSEXtkKCbBecPO/lrIFYxz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • VIDAR mutex has been found

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Actions looks like stealing of personal data

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • VIDAR has been detected (YARA)

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Steals credentials from Web Browsers

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
  • SUSPICIOUS

    • Reads the BIOS version

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads security settings of Internet Explorer

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Multiple wallet extension IDs have been found

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Searches for installed software

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
  • INFO

    • Creates files in the program directory

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Creates files or folders in the user directory

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads the computer name

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Checks proxy server information

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Checks supported languages

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads the software policy settings

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
      • slui.exe (PID: 5376)
    • Reads Environment values

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads the machine GUID from the registry

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads CPU info

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Reads product name

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
    • Themida protector has been detected

      • 9d79fa9eb281db34a0bcbdb9b7025a9c.exe (PID: 5800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(5800) 9d79fa9eb281db34a0bcbdb9b7025a9c.exe
C2https://t.me/g_etcontent
URLhttps://steamcommunity.com/profiles/76561199832267488
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:24 04:48:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 115200
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x457000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #VIDAR 9d79fa9eb281db34a0bcbdb9b7025a9c.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5376C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5800"C:\Users\admin\Desktop\9d79fa9eb281db34a0bcbdb9b7025a9c.exe" C:\Users\admin\Desktop\9d79fa9eb281db34a0bcbdb9b7025a9c.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\9d79fa9eb281db34a0bcbdb9b7025a9c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Vidar
(PID) Process(5800) 9d79fa9eb281db34a0bcbdb9b7025a9c.exe
C2https://t.me/g_etcontent
URLhttps://steamcommunity.com/profiles/76561199832267488
Total events
6 857
Read events
6 854
Write events
3
Delete events
0

Modification events

(PID) Process:(5800) 9d79fa9eb281db34a0bcbdb9b7025a9c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5800) 9d79fa9eb281db34a0bcbdb9b7025a9c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5800) 9d79fa9eb281db34a0bcbdb9b7025a9c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
58009d79fa9eb281db34a0bcbdb9b7025a9c.exeC:\ProgramData\d2dba\mohlx4text
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
46
TCP/UDP connections
61
DNS requests
18
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
2104
svchost.exe
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
POST
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
text
58 b
malicious
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
GET
200
149.154.167.99:443
https://t.me/g_etcontent
unknown
html
12.1 Kb
whitelisted
POST
400
40.126.31.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
whitelisted
POST
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
text
2 b
malicious
POST
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
text
2.13 Kb
malicious
POST
200
20.190.160.22:443
https://login.live.com/RST2.srf
unknown
xml
1.35 Kb
whitelisted
POST
400
40.126.31.69:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
5800
9d79fa9eb281db34a0bcbdb9b7025a9c.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
2104
svchost.exe
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5800
9d79fa9eb281db34a0bcbdb9b7025a9c.exe
167.235.59.196:443
x.p.formaxprime.co.uk
Hetzner Online GmbH
DE
unknown
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
t.me
  • 149.154.167.99
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.156
  • 23.48.23.155
  • 23.48.23.163
  • 23.48.23.153
  • 23.48.23.160
  • 23.48.23.151
  • 23.48.23.159
  • 23.48.23.162
  • 23.48.23.191
  • 23.48.23.190
  • 23.48.23.181
  • 23.48.23.134
  • 23.48.23.137
  • 23.48.23.193
  • 23.48.23.194
  • 23.48.23.185
  • 23.48.23.192
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
x.p.formaxprime.co.uk
  • 167.235.59.196
malicious
login.live.com
  • 20.190.160.2
  • 40.126.32.133
  • 20.190.160.131
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.67
  • 20.190.160.20
  • 40.126.32.140
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
5800
9d79fa9eb281db34a0bcbdb9b7025a9c.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
No debug info