Extracted

Extracted

• • Target

    9e5eb02dd5ddfc26a381313863b1f5d78e72c15b2a78500a83ec024dae202157

  • Size

    5.0MB

  • MD5

    865306ffc5542139a3d57219ed1548bc

  • SHA1

    7da9b0e42bd66f36556d3fb2e62db17c061d184f

  • SHA256

    9e5eb02dd5ddfc26a381313863b1f5d78e72c15b2a78500a83ec024dae202157

  • SHA512

    033fca1c0f72348c41d4e062633a6ff04edb5fd6235bf8af831faa30ac956fea775a6ea0a40791c30c6a265d37d86e17226eb0d771a64e4e92c0f72d832464b6

  • SSDEEP

    49152:vL/Johw36b9y1H8tatteWuwRYBRczgpYIugrrwOUGQZjdXd7Eh28gZV0E9yJglZU:vLhUwKy5RKczgy8rCGIm0H6gBvMnK4

  Score

  10^/10

  lummastealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2