General

  • Target

    f24d1ef9ffb8be85e5b7f03262eb2e88.bin

  • Size

    199KB

  • Sample

    240914-b7msba1era

  • MD5

    9db724249d7bec695a34d308e40703ad

  • SHA1

    29ce4df6a4f5ed30a6b8be66a4c155711ed6d2fa

  • SHA256

    b49bc6b12ff8f1ca0ae40aec74164e15a57d3972a672b17acdcce98597db644d

  • SHA512

    ede70713c2b164b07a6e198e978f18e71332086dee42e4b8fd936685aae84105af7a3b64bf4a047bdb4e57558ed9015cfb3e6ec2e49576f23be415b6bd45191c

  • SSDEEP

    3072:t+wvHxfB66ZVQ4AoUNJq2cuxYu2j+xmnsF7vBuqinS1PAGY7UFSmg+IEk9Ms2xB:t+EHxp6oVQYUD9AzsFt9iYAL9O9+t2T

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

C2

https://complainnykso.shop/api

Targets

    • Target

      c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0.exe

    • Size

      206KB

    • MD5

      f24d1ef9ffb8be85e5b7f03262eb2e88

    • SHA1

      ca80ca5aa19037b424f73de09d52f079032ea546

    • SHA256

      c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0

    • SHA512

      4b0ddd0ad28f7fd30324add6623f399dec43df33d0e9bb24788c0d0e96c1b2f25b96644b5320755299b1d2fb66e4417a0402fd6729d3ed33aec2117c485c3567

    • SSDEEP

      3072:9KTLxfhx7l2jvaPdUWnNWBjwS9KKjossreeIWXAM40P+7pq8fQ4+W18khmlAm2M3:0xpxkvaPRLboE2Jo4h1PIEO

    • Detect Vidar Stealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Stealc

      Stealc is an infostealer written in C++.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks