Extracted

Extracted

• • Target

    2529fedf71b1b54b4084a59546956dad83c173fe02e02700cc04b78594cf0727

  • Size

    6.4MB

  • MD5

    b50c1e840e9452d6898eba3458982e88

  • SHA1

    b0144d10b4da7a3074aec23d570677f11a3201de

  • SHA256

    2529fedf71b1b54b4084a59546956dad83c173fe02e02700cc04b78594cf0727

  • SHA512

    dde0ad5cd22c0eea8faebf16bf28dcb07e3a51e46a1573ea857c7a79a832f70f750e670b1e66577c867402714b22e074de0216db9359c299615b5d73122fa0e8

  • SSDEEP

    196608:fgZ1CgmuCZ92WTs6YoQB3NhPn9PKcWkFV:fWV9CZ9n54hf9DlV

  Score

  10^/10

  cryptbotdiscoveryspywarestealerlumma

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2