Overview

overview

10

Static

static

1

lem.exe

windows7-x64

7

lem.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lem.exe

  • Size

    15.8MB

  • Sample

    250219-yrllmszls4

  • MD5

    0c38e5cacc997db36aeb4678c1ddf3bc

  • SHA1

    30f528e119e699de15b48ea9365dc07a096a580f

  • SHA256

    62c09b2435ff52e29a56f8474f6307084383d73ecbf5dc62bd9767a23d50ec39

  • SHA512

    51a8b0595cf3d909de2940380e75f07b4538875667d6f4857200289e995bdc44cb2082d1537e3e07b0a36eaf1d40f082723af4dd940ffc24a2619c83c5a2597b

  • SSDEEP

    393216:Pkcbf0j8aPknFM7mqF6WEuDLEXgqqIv1MCNrrPgLX3wRHyNn:ccj0PPknFymqXE8gXKkJrPgL6SZ

Score
10/10
vidarcredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      lem.exe

    • Size

      15.8MB

    • MD5

      0c38e5cacc997db36aeb4678c1ddf3bc

    • SHA1

      30f528e119e699de15b48ea9365dc07a096a580f

    • SHA256

      62c09b2435ff52e29a56f8474f6307084383d73ecbf5dc62bd9767a23d50ec39

    • SHA512

      51a8b0595cf3d909de2940380e75f07b4538875667d6f4857200289e995bdc44cb2082d1537e3e07b0a36eaf1d40f082723af4dd940ffc24a2619c83c5a2597b

    • SSDEEP

      393216:Pkcbf0j8aPknFM7mqF6WEuDLEXgqqIv1MCNrrPgLX3wRHyNn:ccj0PPknFymqXE8gXKkJrPgL6SZ

    Score
    10/10
    discoveryvidarcredential_accessspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks