Extracted

• • Target
    FieroHack.exe
  • Size 39.2MB
  • SHA256 ec7d96e3c629e12e1940eb0f793233cb777493d0949cddf9812b44d0bdef7795
  • MD5 29faecf8e5894beed9571d129d1891ab
  • SHA1 b793ead35c6d3428c2bcea8036e1e3a6d85b72e5
  • SHA512 f74c7c11022af4f24a0ca7f0a2f9f1b7e79766fd6d199daa2a1c3aa4ca49fb2d687559bf4061b4d02a0fc542e0ca7c287fdba634d0f931d30989438d491cc96f
  • SSDEEP 98304:KrLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvdq:IhIkwt+x31/CICj1lg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummaxmrigevasionexecutionminerpersistencestealerupx

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4