Extracted

Extracted

Extracted

• • Target
    file.exe
  • Size 362KB
  • SHA256 53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e
  • MD5 38da35e91c9aeea07d77b7df32e30591
  • SHA1 49eebb6f1db4065b62e276f61c6f2c6abc0cb66e
  • SHA512 739d88b2df68063eb0771cfa538bc5fdf9f3485c114c454dfa0dcce554e89cc39e3b970d689bd4c8a80ad595761a39928620cf43c05feb0aea92433870f0b8e0
  • SSDEEP 6144:YFDI5CzTBC/2tX8QPfembZUrALjlX4goEjkelY2NW2UYclVyqMvhm:YWCzTM2dzPblUrAv5oSs2UZAhm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummastealcvidardefaulte3a5dc9f3619e7e1987b9fcc98b49843credential_accessdiscoverypersistencespywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2