Extracted

Extracted

• • Target

    suhaag 1994 full movie mp4 download.exe

  • Size

    890.4MB

  • MD5

    cfaefdb151a490dc8047af6843b53b7b

  • SHA1

    e07aebd16c38cfcb560ddcd075a2c89aa28ae18c

  • SHA256

    f7089901034876bd1e7bb7c9bd510a5e829897237b619f08eec99f6685fc9aa8

  • SHA512

    ae72fa594c780056e0da0919d36b2790280eb91939ef74af098642918386eac9f8e9addf0d6bcd272c79996c30871b34696bdd97dd297740d892f3f4ae3c4f63

  • SSDEEP

    393216:m+3MOe3n7mOxAUUNGD/FZkfijYUy4FtPIapG0VvXHFjHmTYAAzX:i7iI/Ufi3ybuG0RXFjHmvAzX

  Score

  10^/10

  lummavidar3a15237aa92dcd8ccca447211fb5fc2abootkitcredential_accessdiscoveryevasionexecutionpersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4