Extracted

Extracted

• • Target

    74dc3e0016940aa082c217ef02fa2ad7d712f0739f0ea8efadbe237745d3770d

  • Size

    4.4MB

  • MD5

    8639100befa5a036c2be28182dada897

  • SHA1

    08e20cedbb0febd60878d33f062860c719524474

  • SHA256

    74dc3e0016940aa082c217ef02fa2ad7d712f0739f0ea8efadbe237745d3770d

  • SHA512

    d43177e495274cf6fd40e4795d50801860f65354d9dd0d8df9e0d0f0ecf1e2ce40fcacf9a2c905c29628b5e292746bec24609c4c059838f29bbabe2a4bbc808f

  • SSDEEP

    98304:QsEn3qlcx7DhApl7cedBWLZcsD68ucrwTK8D9xHY:gx7DhAj7cSWZzwTKuy

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealerlumma

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2