Extracted

Extracted

• • Target
    file.exe
  • Size 13.2MB
  • SHA256 98636755633560832c7621a4b85f08553f513c0eee2ad21cc277044349b17075
  • MD5 89c2a0024c8fb9afe5a54592354c56af
  • SHA1 b025c8d428f4e33f6de7ea0151f0ef5b5babc89f
  • SHA512 62e1bf2198f0d50b23c89f0154bdeffe8b5fbabd841cb4bf32bd9777ad07173e9b4c4eb4ab2b52bbdad31097b9543e1ab0247c58cce42c0480611cb3c33d3252
  • SSDEEP 393216:LTwC3d3ZurVpI+Jww5YDn2R6sJXnOO0CHJmQya4S4I9:LTFdL+2wq729JX/0CHY49
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypyinstallercryptbotlummacredential_accessexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2