Extracted

Extracted

• • Target

    15833f92c23ba3afbba0f4f273274452.exe

  • Size

    2.4MB

  • MD5

    15833f92c23ba3afbba0f4f273274452

  • SHA1

    f9f68f691644f7be60128ede3005699e7d6f4941

  • SHA256

    7aa7c19de5eaa2409006038a7d0d7423dd0c7d9b3d9514ffb8d790e4fdc51d2c

  • SHA512

    cfe3e16c91e9013c259dcd52527bc458d33b568459995238d8356abf4bb2438a425aa01d517f0ca16e096b80114e6af234dde43cc4ce082f75163f52660f1690

  • SSDEEP

    49152:vslBubuANjnMenjn+TH2dfdWVOm+C8tNPd1Zyiu+vbFxqiedJBBmUdP:vslgb9lMkhd1WYmpktd1ZDvbTqRfBrdP

  Score

  10^/10

  lummawarzoneratdiscoveryinfostealerratstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2