General
-
Target
f24d1ef9ffb8be85e5b7f03262eb2e88.bin
-
Size
199KB
-
Sample
240914-b7msba1era
-
MD5
9db724249d7bec695a34d308e40703ad
-
SHA1
29ce4df6a4f5ed30a6b8be66a4c155711ed6d2fa
-
SHA256
b49bc6b12ff8f1ca0ae40aec74164e15a57d3972a672b17acdcce98597db644d
-
SHA512
ede70713c2b164b07a6e198e978f18e71332086dee42e4b8fd936685aae84105af7a3b64bf4a047bdb4e57558ed9015cfb3e6ec2e49576f23be415b6bd45191c
-
SSDEEP
3072:t+wvHxfB66ZVQ4AoUNJq2cuxYu2j+xmnsF7vBuqinS1PAGY7UFSmg+IEk9Ms2xB:t+EHxp6oVQYUD9AzsFt9iYAL9O9+t2T
Static task
static1
Behavioral task
behavioral1
Sample
c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0.exe
Resource
win7-20240708-en
Malware Config
Extracted
stealc
default
http://46.8.231.109
-
url_path
/c4754d4f680ead72.php
Extracted
vidar
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
Extracted
lumma
https://complainnykso.shop/api
Targets
-
-
Target
c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0.exe
-
Size
206KB
-
MD5
f24d1ef9ffb8be85e5b7f03262eb2e88
-
SHA1
ca80ca5aa19037b424f73de09d52f079032ea546
-
SHA256
c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0
-
SHA512
4b0ddd0ad28f7fd30324add6623f399dec43df33d0e9bb24788c0d0e96c1b2f25b96644b5320755299b1d2fb66e4417a0402fd6729d3ed33aec2117c485c3567
-
SSDEEP
3072:9KTLxfhx7l2jvaPdUWnNWBjwS9KKjossreeIWXAM40P+7pq8fQ4+W18khmlAm2M3:0xpxkvaPRLboE2Jo4h1PIEO
-
Detect Vidar Stealer
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4