Family comparison

RiseProStealCVidar
Capability
RiseProDeclining
StealCActive
VidarActive
PlatformWindowsWindowsWindows
Dark Radar infection records632,7721,847,8205,662,081
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions———
AutofillDark Radar observationVerifiedVerified
macOS Keychain———
2FA and password managers——Verified
Financial
Saved cardsVerifiedDark Radar observationVerified
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsReportedVerifiedVerified
Clipboard address replacement———
Applications
Email clientsDark Radar observationVerified—
FTP clientsDark Radar observationDark Radar observationVersion-dependent
VPN clients———
Messaging applicationsDark Radar observationVerifiedVersion-dependent
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionReportedVerifiedVerified
ScreenshotReportedVersion-dependentVerified
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload download—VerifiedVerified
Persistence———
Anti-analysis—VerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed