Extracted

Extracted

• • Target
    file.exe
  • Size 13.2MB
  • SHA256 806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a
  • MD5 56c671ca2f1c447d9626235f396c870a
  • SHA1 3bc86393d8b3f0e20e8b49466c48c0a54a03fd61
  • SHA512 44e253da47ec0aa276cbe2abdf4186e9634eb81176a8a9263b48eda3f44346179a380c4b76c157c14740dcb3675dd91ffbf16a7f60accdaedaa58b74a2d313e6
  • SSDEEP 393216:e0qJtXxO7qhaKNDJCvTV7D3OwjdAjLnDUFXoQcnU:e/t2KNJC137dAjEFSU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypyinstallercryptbotlummaexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2