Extracted

Extracted

• • Target

    1586d3a569933b2bbf65c97b9e104d43956eb4e057edc018c329d5a9a5800318.exe

  • Size

    580KB

  • MD5

    c84cf68fa56d169c1156c124cbd9dfbc

  • SHA1

    5929ac3bc9d010755efc6b353268310c1624dace

  • SHA256

    1586d3a569933b2bbf65c97b9e104d43956eb4e057edc018c329d5a9a5800318

  • SHA512

    c724bea52356148f29c106e1ef122d25533ab6e2518c29b1e5a3c73ff48e094d60d7552019054d8ce845d038aab95d4cc30362bc876fde447341c596ab161172

  • SSDEEP

    12288:jK7qQnYbvtP2qLaeHip/DYXaRsAbpZLRL7ZW/prKa:jKtnYjXRHipMavtZLlY/Fr

  Score

  10^/10

  lummavidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2