Family comparison

ArkeiVidarStealC
Capability
ArkeiDeclining
VidarActive
StealCActive
PlatformWindowsWindowsWindows
Dark Radar infection records119,4735,662,0811,847,820
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesDark Radar observationVerifiedVerified
Refreshing expired sessions———
AutofillVerifiedVerifiedVerified
macOS Keychain———
2FA and password managers—Verified—
Financial
Saved cardsDark Radar observationVerifiedDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensions—VerifiedVerified
Clipboard address replacement———
Applications
Email clients——Verified
FTP clients—Version-dependentDark Radar observation
VPN clients———
Messaging applicationsDark Radar observationVersion-dependentVerified
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionVerifiedVerifiedVerified
Screenshot—VerifiedVersion-dependent
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload download—VerifiedVerified
Persistence———
Anti-analysis—VerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed