Extracted

Extracted

• • Target

    b731087236662a029e0bb94b08212b7fdf131a071862613c4531c02712b3f5f9N

  • Size

    580KB

  • MD5

    79feff89beec711a92da359988750de0

  • SHA1

    40c469e552addc0c3640954b9b9f54b2502fa4d0

  • SHA256

    b731087236662a029e0bb94b08212b7fdf131a071862613c4531c02712b3f5f9

  • SHA512

    5c4aca94deae57952a7763036245cee58f1971c999590de962400943c9ce9dc68723d5c2a8f61024520c9d679cb986ec761e7b3bee96fb9116f48753e5cb1aa2

  • SSDEEP

    12288:qKzCYvQ2v9E54yanWncFnaVe2RaJmhM7C/IQYVYl1MrKM:qK1vQaBjnWm6AuM7CQjYlIN

  Score

  10^/10

  lummavidarcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2