Extracted

Extracted

Extracted

• • Target

    66cf81753addd_vsldqfs15.exe

  • Size

    191KB

  • MD5

    8ae4605ae214af3ba375ad58263ca707

  • SHA1

    483c4442d923c66ac17a479667dd105a928c9c7e

  • SHA256

    3b434c699bd12fe3d7cadf72b13a935b1c9c097064e0a72d2ce6729bef59c4bc

  • SHA512

    cff4d4bae71685abb78e129dd3eba1d0af93e34a3ad417d5471e82c111fa51e8b6e18ce4e765ba89dae8866aa0cc652d04abb10bd74e1de2cc72297474ec037c

  • SSDEEP

    3072:xzGDr6OuWXicgg9VVdrxF/C2730oedT16M0R905WZXyhwVSwG/RtD1x8a111g675:xzGDYWScj7zF/C27oT+WWo5fIaT1f7jt

  Score

  10^/10

  vidar2518023737b2c1df77f6bd2c06d44ffed9949d63cb2f6fce6f80667c0c98ea24credential_accessdiscoveryspywarestealerlumma

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2