Extracted

Extracted

Extracted

Extracted

• • Target

    UpdateClean.js

  • Size

    5KB

  • MD5

    d6942e22893e95deea7bbe9d9f9e2a94

  • SHA1

    4d002c2b134d52d0ce8a6715e1ab75b4dd36d4d9

  • SHA256

    b3bdd33dcaf6d7453e5aca839f814ba5754b7b4f5b119890c8f4a16bf149c9ad

  • SHA512

    b1969093839283c68928bd38f8ee0788d85ce71272e18e59316897b223b6d94178464360d7d0e204bd78ea315bfc452607f22a4fbc30686c8439f125124d3b80

  • SSDEEP

    96:rBup4W/ul47KmtSzemZYSBTJABlaxVRo/JR3Ui7RDqG1+qnA++B+k+++8H+e7it5:rBu6W/N+qS1ZjJAixVRo/JR3N7RLr+ru

  Score

  10^/10

  bitratlummapersistencestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2