Extracted

Extracted

Extracted

Extracted

• • Target

    AmsterdamCryptoLTD.exe

  • Size

    130KB

  • MD5

    2cf4b9e8d659b05babf589d2e43c99bb

  • SHA1

    6af4c7dc71687006c29b75bfac50324bc7bd8f1e

  • SHA256

    6760736035348f5a320dfde45458b2dc910cd08965c6541be97dcf490ab2a149

  • SHA512

    a86c2f45e1c2b9774c6e8076cfed665c776bc24fc3f52da25eb81f3222114f1c8ed998c35dcac94544ae8a6321a4d5189a13e9d99a7b5591af194a6555871f8c

  • SSDEEP

    3072:Df1BDZ0kVB67Duw9AMcbbiFAjrYEOnEjbWicBGIgPjzgw0XIu0I/2jAI:D9X0G3DjrkJiUgPH/ubXI

  Score

  10^/10

  darkcometlummavidarguest1690credential_accessdiscoverypersistenceratstealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2