Extracted

Extracted

• • Target

    a72af6c3293eb3061bba1e48ba6147de.exe

  • Size

    571KB

  • MD5

    a72af6c3293eb3061bba1e48ba6147de

  • SHA1

    316276ac440f65361db52e49a7fc4d2a9be1f457

  • SHA256

    7dc3d6e633cbabe95c39fa36f94ab6657e3c04dab7a9a6c1f79c9e2424378e00

  • SHA512

    3bea2955df160fc3ce1ad61c0cf1a6946bf4d12147596e63ff3eb359db9af4f32ea8e0595c65bec0d5651f76a029a9afac621fab08e5e21c7b1f8794740617ca

  • SSDEEP

    12288:eMs0xfgBSzc9gm8naRK1RDr/EbeWsFU37LpZdE3f8Hcz74S:eWfgv8naRK1Ncbe5S/jsf8SU

  Score

  10^/10

  lummavidar4a5bc8b73e12425adc3c399da8136891credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2