Extracted

• • Target

    sample

  • Size

    31KB

  • MD5

    e27e172a8e80e62005a29cdc12d71c5a

  • SHA1

    d9c361abfaec30bff360f6c4a3fc2af70f01e2f8

  • SHA256

    40654752138655a2f2fc6c9107fefb2f840d89b5d2d2f59941d21ea119cecbcf

  • SHA512

    ffe236fbca3f537b3a81861332620aa523b039111c49730b1ef23f1920e07cac4f9e8046b6b87ba23246628d9de036bf5e1c1c4e7ee52858132708365a8a5bcd

  • SSDEEP

    384:nH0edPP0ucjdey1YKfPn5TP3QQBtiUEzVjWWAoP6J94XyTKbPV6+xxdPP0ucjdeO:nGZv3xBtiUERjWt4mqyTKRzqZbmXml

  Score

  10^/10

  lummarhadamanthysexecutionstealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1