Extracted

Extracted

Extracted

• • Target

    Stealer/663F2250.exe

  • Size

    666.6MB

  • MD5

    7ee53007b688c7f40c81160100026f39

  • SHA1

    4ab59105a39b0e2a55db44a2eeae1c0a3634e1b4

  • SHA256

    e8e20414885d7bae4da294b531eca58e4ff8d8918345e1bd741f1f3f29e01f68

  • SHA512

    392d0140a15b7fa4ebbbb3265be841d65a943ab8f732224c7ba7688ca91d439202569df59f4175855898f3a57b8cae0bcd36819133b0d6b01be09ed24b1999b1

  • SSDEEP

    12582912:sQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQ2QyQyQyQyQyQyP:snnnnnnnnnnnnnnnnnnnnnnnnrnnnnnP

  Score

  10^/10

  vidarhttps://t.me/eagl3zdiscoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2

• • Target

    Stealer/BA00054A.exe

  • Size

    33.7MB

  • MD5

    391148ba6a49c21f1561f0b358c4adc5

  • SHA1

    9eaf6f202172a3bdaa5ef751b9e3ed359eb4557a

  • SHA256

    75cd90a2f1d3620498799556ea9b9217aa5048c27db0a31f6f365cf01d713bd0

  • SHA512

    628b51c10748c0635ff3409e14546257ebee44fc45cfc48f1cb51e73d99fa8bbe7cc9e4250a5cecf6059bfbf859aacdbe12670e83103042a6eb346e21f4c4423

  • SSDEEP

    393216:k5zFjww2tS26qtUkzgwhTlGQx2YR+1WPe6vcYEa75Y7sizuQUZ8q5q5XiMusXNRp:krOiY9TlJckPeK3P7+vDqY9VJnp

  Score

  10^/10

  vidarhttps://t.me/hwbhjegyuvbgyuggespywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    Stealer/C4A17DBA.exe

  • Size

    755KB

  • MD5

    b0517305850d5be8e02a648bb90a3c6d

  • SHA1

    24e75c0ea6b07fd3c4e03c6661ed911632f3e784

  • SHA256

    5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204

  • SHA512

    17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af

  • SSDEEP

    12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a

  Score

  10^/10

  lummaspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral5behavioral6