Extracted

• • Target

    Hydra.EXE

  • Size

    3.7MB

  • MD5

    79250696b412b3acd36a9e1b1d7f4db1

  • SHA1

    158ad1ab19323ce8999352d9f014057e6d8869cf

  • SHA256

    ecbbe3b48575f2c2476e2f5b2f94668ed072503e6d0038b50372ac2ff613a27c

  • SHA512

    c40dae620cd7e2572fa270f6d28747668bf6e3d70fd826b9a7cd74a3313026ddbfd0a8498efc72c034bc020a3c41b6729740a50cf4611f90bad2e408d4e81cda

  • SSDEEP

    98304:pxHCOQ6fkzgneNNNNAlPB5RD2Ju/pnlnYJGs0d50UMcB7U:LiTgne2BH2JcpnJs0T0UR

  Score

  10^/10

  lummanjratdiscoverypersistencestealertrojan

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1