Family comparison

VidarArkeiStealC
Capability
VidarActive
ArkeiDeclining
StealCActive
PlatformWindowsWindowsWindows
Dark Radar infection records5,662,081119,4731,847,820
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedDark Radar observationVerified
Refreshing expired sessions———
AutofillVerifiedVerifiedVerified
macOS Keychain———
2FA and password managersVerified——
Financial
Saved cardsVerifiedDark Radar observationDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerified—Verified
Clipboard address replacement———
Applications
Email clients——Verified
FTP clientsVersion-dependent—Dark Radar observation
VPN clients———
Messaging applicationsVersion-dependentDark Radar observationVerified
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionVerifiedVerifiedVerified
ScreenshotVerified—Version-dependent
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerified—Verified
Persistence———
Anti-analysisVerified—Verified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed