Extracted

Extracted

• • Target

    64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f

  • Size

    550KB

  • MD5

    cf53e6a7d56bf434be708446086ba2d6

  • SHA1

    cb4df70615ed22b9aa6acfcfe804b717197d00da

  • SHA256

    64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f

  • SHA512

    780c03ee844829c7c47ae779e8343616507d1aa4d4c814c2960dc8167f84e17e6daecfe2812e7500a95c7113b240e6bfa03e7813913db88e826b97c26d1f5ce2

  • SSDEEP

    12288:9kAw4CrufBG6P0BVYp6e/r3q6qeDT9yGZ1P:9ibLeaYpB63eDT9/Zl

  Score

  10^/10

  lummavidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2