Extracted

Extracted

• • Target

    file.exe

  • Size

    580KB

  • MD5

    0dd02c48ff88cab7eb2129f72fb48a36

  • SHA1

    0e46168f7ebf6fc6130b07acb867e1f4e2f3c2e1

  • SHA256

    7636924a11e30d0ac5f8a2a7fb2b73416816565d059dbb0123324717eba828e2

  • SHA512

    116e53ae4158104601827e62e0b82d35ab7e8d60859eef79fb932e8ba77aef1a55dbcf8f0a81ab788915a683628ab39c61e10e3ef106310612822dd937bb47ed

  • SSDEEP

    12288:amCaBY9nY8vFbsnzdraM4eH9pQXcELgc0vE54D3kcBdIiKEO:caonYlraOQC94ckQWZt

  Score

  10^/10

  lummavidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2