Extracted

Extracted

Extracted

Extracted

• • Target

    7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN

  • Size

    2.4MB

  • MD5

    f90c52db6e76bbf49b3548752a42fbc0

  • SHA1

    c11797420520129905162460d30795a70da8bde4

  • SHA256

    7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43a

  • SHA512

    758419b24f9e17fa64090b7ea036fc2db89e959d1801a1cc4a3323d364fb925da1a9ed89e3bf5d1e84ea02758445820a46bd2f3c0ef0d3065c1a51a39c8aded7

  • SSDEEP

    6144:FDi8xYtUokCulxMfpbK+engkcrFscU77+Uw3N/RQv8Yt9:CtUoH3Q+ocFhI7x8/Ret9

  Score

  10^/10

  lummastealcvidar8b4d47586874b08947203f03e4db3962defaultcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2