Extracted

Extracted

Extracted

• • Target

    cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df

  • Size

    187KB

  • MD5

    9837c3f3238d85d6bc07935cbe764206

  • SHA1

    33b273680cb8647e137f8bbb43dbc53380fdec53

  • SHA256

    cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df

  • SHA512

    533a64cd597bd139063f8da6cf4fabbb202f6165a38e9ce8d0279fc7401dc255d68bc89f45538df8c0b043673cea9f0bfd8e4a09a1c8bf0da8da91f55dbbce8b

  • SSDEEP

    3072:uMLgD6NIYVsjEwh0YhWvivt0xoJdW20m2JAj5AeVHC:5LgOijI28Kvt0CPW3m2JnW

  Score

  10^/10

  lummaphobosrhadamanthyssmokeloadersummbackdoorcollectiondiscoverypersistenceransomwarespywarestealertrojan

  • Detect rhadamanthys stealer shellcode

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1