Extracted

Extracted

Extracted

• • Target

    61ffde65177f9cea78164dd99fe7ecfc7ff9f95309f9b9b7d631870faedf6710.exe

  • Size

    404KB

  • MD5

    15e48f59b50e093dd715c721cec58a29

  • SHA1

    9e8a996b0a8a3c78b7a90bca971d8dd015d5885c

  • SHA256

    61ffde65177f9cea78164dd99fe7ecfc7ff9f95309f9b9b7d631870faedf6710

  • SHA512

    681a6c84a0f2bc8f6d5fe0ce8559b77a9844655385222494ebab191090859415fe7aa88f5834362480a71e982e8c1d02cace1d5b0589693b49495d9face5d497

  • SSDEEP

    6144:hWDZTxXwKjzPrI1UEnjGVqpQduF2dupEzn3ZFunIYUNQ6ZRuR0nXjXzDzgSqqeBj:2Jfajqq8ucd6K3ZFunmHZRu0XXD0JjEO

  Score

  10^/10

  lummavidar8a5f3a9817555d8b0b805aaf007d558dcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2