Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    0d32dd29b0a5a4e593651b4f0ffba9d7ba7c6d243666bbdfa83eabe9d3aa5119.exe

  • Size

    413KB

  • MD5

    03cba9d84f72262d5de29968fd428514

  • SHA1

    e8d35aebdd401108a67bf519c90b19033fb1f02f

  • SHA256

    0d32dd29b0a5a4e593651b4f0ffba9d7ba7c6d243666bbdfa83eabe9d3aa5119

  • SHA512

    72be8db459012db13efcc73f5a55d7965b48f2fda6e083dc1d76b8cc7d792483306dcc30e7a0b2ec88625bea3c7cf5feb90e05f691e8bed2a38434d0ff6ffef0

  • SSDEEP

    12288:KLjV2QOQ/F8cRg7C2iajglWPlKS5KbtjmGnEO:+XO6BK7fiM6+ENRaot

  Score

  10^/10

  lummavidar8b4d47586874b08947203f03e4db3962ac3f3299a35695efca009a30beb2c332credential_accessdiscoveryspywarestealerstealcdefault

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2