Overview

overview

10

Static

static

3

8f684bccf9...90.exe

windows7-x64

10

8f684bccf9...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f684bccf9d9e64599a2d6c856bd0ea954116111c57e31b5d5aa954cd6ae6e90

  • Size

    551KB

  • Sample

    241005-cccvasyerl

  • MD5

    28d92f32cdbc53214f6c1c36987cbf7d

  • SHA1

    7844ef48201fe4fd8ec8ccfc95b19fb95eb3b3d9

  • SHA256

    8f684bccf9d9e64599a2d6c856bd0ea954116111c57e31b5d5aa954cd6ae6e90

  • SHA512

    99f8901e0e0db8e0db30a8aa2be5b11242e353c12a2c294379fef547f1ff75b95d1fa8f18c101ba975eca70b1ba65286d7734ba1c4669d5f25750e20ae403a3e

  • SSDEEP

    12288:fKzXYJTVv5j0FcFAUdTYx8ptuBbiGFI0Y6MqsP:fsCVoUbtYx8WBbk

Score
10/10
lummavidarcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

C2

http://proxy.johnmccrea.com/

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

Extracted

Family

lumma

C2

https://spirittunek.store/api

https://mobbipenju.store/api

https://eaglepawnoy.store/api

https://dissapoiznw.store/api

https://studennotediw.store/api

https://bathdoomgaz.store/api

Targets

    • Target

      8f684bccf9d9e64599a2d6c856bd0ea954116111c57e31b5d5aa954cd6ae6e90

    • Size

      551KB

    • MD5

      28d92f32cdbc53214f6c1c36987cbf7d

    • SHA1

      7844ef48201fe4fd8ec8ccfc95b19fb95eb3b3d9

    • SHA256

      8f684bccf9d9e64599a2d6c856bd0ea954116111c57e31b5d5aa954cd6ae6e90

    • SHA512

      99f8901e0e0db8e0db30a8aa2be5b11242e353c12a2c294379fef547f1ff75b95d1fa8f18c101ba975eca70b1ba65286d7734ba1c4669d5f25750e20ae403a3e

    • SSDEEP

      12288:fKzXYJTVv5j0FcFAUdTYx8ptuBbiGFI0Y6MqsP:fsCVoUbtYx8WBbk

    Score
    10/10
    lummavidarcredential_accessdiscoveryspywarestealer

    • Detect Vidar Stealer

      stealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks