Extracted

• • Target

    9f6d7bdffe74d66aa89decac533141268ba832a2f34c2beee562bb78f4744982

  • Size

    9.2MB

  • MD5

    678e3ffbb85b7fea9f671d3223e6d360

  • SHA1

    0a6895a902dbc2e5189cdac7f87d4f1b33a496d6

  • SHA256

    9f6d7bdffe74d66aa89decac533141268ba832a2f34c2beee562bb78f4744982

  • SHA512

    19bdf511b7189eba50962973048688406224a368261aae897fa2a9fcf2f63b5294ea2315de02455c2ff381e7b829cab0c0e363a65c16e0ecd9c4bccddbb99bb0

  • SSDEEP

    196608:RNbjuEPa/rnIVl3n403gwmPULMYJwEULY6fbXTU:fPuYUzg340tXd6bg

  Score

  10^/10

  cryptbotdiscoveryspywarestealerlumma

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Detects CryptBot payload

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2