Extracted

Extracted

• • Target

    ea032d9278141463cb1aaf533b471aee.exe

  • Size

    571KB

  • MD5

    ea032d9278141463cb1aaf533b471aee

  • SHA1

    27e519e9e44219aeafeed5ab66cc2c82ef1ce031

  • SHA256

    97596ac4b0b3d839d53b03d9217c7628c977365b49e2f2f3f733441bb02556e0

  • SHA512

    2839065a5cbcefec2d2b6f9233982601c5f01e22216d34a674925ebb1c4d56fbc22d455b094913db3ed24f773489cd668caaa0707cbcf00476ca65e5358636bf

  • SSDEEP

    12288:TcEcpXoWDMa779ECxVxdlMvnYuqbzh45flvHMOLY4S:TOXomBNNLgYuq54ZBHMQ5

  Score

  10^/10

  lummavidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2