Family comparison

StealCVidarArkei
Capability
StealCActive
VidarActive
ArkeiDeclining
PlatformWindowsWindowsWindows
Dark Radar infection records1,847,8205,662,081119,473
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedDark Radar observation
Refreshing expired sessions———
AutofillVerifiedVerifiedVerified
macOS Keychain———
2FA and password managers—Verified—
Financial
Saved cardsDark Radar observationVerifiedDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerified—
Clipboard address replacement———
Applications
Email clientsVerified——
FTP clientsDark Radar observationVersion-dependent—
VPN clients———
Messaging applicationsVerifiedVersion-dependentDark Radar observation
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionVerifiedVerifiedVerified
ScreenshotVersion-dependentVerified—
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerifiedVerified—
Persistence———
Anti-analysisVerifiedVerified—
Verified
Version-dependent
Reported
Dark Radar observation
Not observed