Extracted

Extracted

Extracted

Extracted

• • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbERIZjhRcm4yYVU5aVlxcW1mcUtqMUt4eUstQXxBQ3Jtc0tta25wUWE5T01ZWEFtaURraU1hengxcjRyVEZoWmVuS3dGZkJxMGJfQUlsanYzV1dKNmNTdllDZHFKdlRMdjVSV18zNGRpd0pXUXdOTnhmOWFqcG1GbXJIQXo4Y2ZwcXhjdVNNTWlXUFllZ25NMXB6VQ&q=https%3A%2F%2Fgithub.com%2FAmsterdamA1%2FAmsterdam%2Freleases%2Fdownload%2F2.0%2FSetup.Program.zip&v=nSi4avg7vM4

  Score

  10^/10

  darkcometlummaguest1690credential_accessdiscoverypersistenceratspywarestealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1