This is a unique looking crypto stealer that appears to have been built custom to target a hardware wallet.


  • 3333e2846173468a7bf9dc859e2a0418a4bf1a2840802b397463fce5398fb6d3 UnpacMe



  • Sample is .NET
  • The sample name is Ledger Lives.exe which is possibly an attempt to mimic the wallet
  • The following PDB path is used C:\Users\Kernel32\source\repos\Ledger Lives\Ledger Lives\obj\Release\Ledger Lives.pdb
  • Persistence via the runkey "Software\\Microsoft\\Windows\\CurrentVersion\\Run using the name Realter HD Audio
  • Can take screenshot (saved to screen.png) -- currently unused
  • There is no mechanism to prevent multiple versions of the malware from running (no mutex)


  • port 8080

Wallet Attack

  • Uses a process watch thread to identify when the process Ledger Live is launched
  • The real Ledger process is killed and a message box indicating an error is popped up Firmware verification error, emergency restart

  • The App uses a fake Live Ledger recover screen to trick the user into plugging in their wallet USB (not required for the attack)
  • The following WMI query is used to wait for the USB to be plugged in SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_PnPEntity'
    • This does not require a Live Ledger USB to be connected, any USB will trigger the query
  • Once the USB is attached the app tricks the user into entering their secret recovery phrase

  • This is then sent to the C2


According to UnpacMe SourceIntel the sample was downloaded from a (likely compromised) WordPress directory https://whitecatcorn.com/wp-content/themes/valerielite/13.exe. According to OSINT from URLHaus LummaStealer was also downloaded from the same WordPress directory https://whitecatcorn.com/wp-content/themes/valerielite/updates_installer.exe hash 9648c6034468d7ee150c2b9b2ce088c14793e1ddf235d596ce14ef754e7d1e9f.

It is possible that that LummaStealer operator observed evidence of Live Ledger on a victim and then deployed this targeted Live Ledger Stealer. The stealer shows signs of hasty development (spelling errors, unimplemented features, lack of error checking, etc.). This coupled with the the lack of a mutex suggest that the malware was developed for a specific use case, and possibly a specific target.