Extracted

Extracted

Extracted

Extracted

• • Target

    Start_setup.exe

  • Size

    37KB

  • MD5

    f6f76de82f4a87fcabbe011876e53670

  • SHA1

    b7aec7f9870935daf1faba58aeb2a4deaeba116c

  • SHA256

    a97e2a8da8d70d6f4e5df730b4fe7996e2d6b1cab9971faa4a8ec2857f1eecc9

  • SHA512

    d089c54324467e120fe0040f78f01b663287b7082e70e37bb387b9bd12d94102786259f3318a7483a3edea634c07aa8aecbb10e749fbb1869ae827333f9ccad2

  • SSDEEP

    768:xn04RNfdSXe28HjPxWlk0CoCzXtBi4PY//I0D3fmoxbxAuauIRdzOcSQbNC:h04f1SMHjZ0k/tB1g//I0DuoxbxAHsci

  Score

  10^/10

  lummavidar5e0c4261602b0cd231c9ba5491376d7bcredential_accessdiscoveryspywarestealerpersistence

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2