Extracted

• • Target

    FieroHack.exe

  • Size

    838.7MB

  • MD5

    1d0585eab895c1fd0a71078255f0389d

  • SHA1

    bf47c52f76e3e9fab779ec6cf527377454e05ec9

  • SHA256

    cb1ae1c234b97b5f75d8c8e1f05649b284f9146d89ca5853fcf49ecc0883fd8d

  • SHA512

    0dd7a3b4e8e6f291808113466d2ff29a068531660ec4958f0898fd08102e167859620174878c6e013420611e98efb94754a9ceb8e7dc677ad3d3184994a6d9c9

  • SSDEEP

    98304:YSYl+O1E/Uo8EoT9AfvDm+CIUzwNhSkPsiQ5HiGIzH:YS7Uo/bfyhIUzilXI

  Score

  10^/10

  discoverylummaxmrigevasionexecutionminerpersistencestealerupx

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2