Extracted

• • Target

    PhoenixC2-main.zip

  • Size

    6.8MB

  • MD5

    767721f2bb542638e90ce369b07067e0

  • SHA1

    ced60d212b9f2a154eba8cb08681ab80dd8d5f2e

  • SHA256

    e441d90716cf4bcb4e180616193e4b69cd090757ed5ead4bef6b8f003ed25781

  • SHA512

    e841ac0eac63906353dd5d011d6117a016dfa57e1ba229d0748a1468b604150e61724f18cb767ebf1c9a526578ade1b6160e860a703e67e4f24e8b02ee6f3de8

  • SSDEEP

    196608:vq2Com15bpXRCX2Xmb8jYYr3t/WaEbfUogn/M2fd:2rNXRW2XOWvrd/WaEDUoSNd

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1

• • Target

    PhoenixC2-main/DrakeUI.Framework.dll

  • Size

    1.6MB

  • MD5

    0562b4c97f643306df491a938ae636da

  • SHA1

    0807c37b711374ed4814a9518c9e264517de89a0

  • SHA256

    70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80

  • SHA512

    c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf

  • SSDEEP

    24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF

  Score

  1^/10
  behavioral2

• • Target

    PhoenixC2-main/GeoIPCitys.dll

  • Size

    191KB

  • MD5

    c070f2421851420e832e4f5989a775a2

  • SHA1

    d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46

  • SHA256

    d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131

  • SHA512

    75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e

  • SSDEEP

    3072:87IcHKc0TwY4O6BlLiJxTmd9h1+fJ5uJnjpUoh/ht21hYvpMaoySJHPc8E:8dHV0Tn4pox6d9G4k

  Score

  1^/10
  behavioral3

• • Target

    PhoenixC2-main/HVMRun64.dll

  • Size

    4.3MB

  • MD5

    21184c4444b13c67546c7acf7f6ad8e3

  • SHA1

    806fb111900a0ec8bee1f658c6828b9e005f1111

  • SHA256

    14f61c269509eb27083883d5e8edcf9ed14f3b62cfbfb69f4f7434d64a7fa924

  • SHA512

    9c55f71051f7c83d8644c7eaf500a5ea887aa75886480fcb607e3540f482afde0cc11396e3c2be936bd6418ce76a752132391c97b2620927a9a694eee99380eb

  • SSDEEP

    98304:1JArZsVn2qEP6Z5AF8qRHNKs9KtEXMURNZpe5:o0tkY5sHh9FMURN

  Score

  1^/10
  behavioral4

• • Target

    PhoenixC2-main/HVMRuntm.dll

  • Size

    2.2MB

  • MD5

    559f1a94d4fadbe42745200c5deeb94c

  • SHA1

    606e336a95c22d0a5bd260af68a3321a284a7270

  • SHA256

    52cf690f3436c9e98a2ab13e2871ca95da72c34ea5dd36d5c52ecccfa78b5696

  • SHA512

    49b85d97f32322cac68c811c7f0268b6d0a71f2dc4428281d724aab0355544da4b33aebffe72e5b92d0b024e40c29392bade4eec2f00c98a46a44eb3e1e547fa

  • SSDEEP

    49152:eX8t9RJHZ9rXOjClE3xNP8AHn9yHyS4LdR1eFcDmoFwHqM9iJ4YI:eMttZVOG237PwSS4BfZDmCwKMs1

  Score

  3^/10

  discovery
  behavioral5

• • Target

    PhoenixC2-main/LiveCharts.MAPS.dll

  • Size

    53KB

  • MD5

    dfee15e4c6efa37e6645d8b47c8581e0

  • SHA1

    876140e0855fcd15bfb590431fb7b280d1db4a21

  • SHA256

    5b8a9a04f454a2c4da5989fa454a0138d3e5c40712816600f90111b7bf045c40

  • SHA512

    4d0e7b0a5642b649c04e54d89e707ec00e79a0fa282eac19b6097b819652045c3e157763b5b2922a4c2252b0877059ef90eb60038280dbfbef9502f421d739df

  • SSDEEP

    768:r4gOx89xKERw2U11HI+bZO603JLw8MOrNNLSW5/5xTcb2y1ehVHp:rPKB22HIwwFNuC5N6n+VHp

  Score

  1^/10
  behavioral6

• • Target

    PhoenixC2-main/LiveCharts.dll

  • Size

    148KB

  • MD5

    9642899636959b7fc89bf34a8b998a90

  • SHA1

    479a0254d1c9e5565c7d861bb77f54b7eae50c96

  • SHA256

    9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca

  • SHA512

    435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2

  • SSDEEP

    3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z

  Score

  1^/10
  behavioral7

• • Target

    PhoenixC2-main/LiveCharts.pdb

  • Size

    355KB

  • MD5

    f3c4997da85fc8495388fc5ea284a697

  • SHA1

    2c82ee0278886b217e7dd92ea3351aced72893c8

  • SHA256

    cb8b4cdeb2ba07ecfc6686840a94c2ac626a2f9d577aff2d16e4d69ea086200c

  • SHA512

    f0e038c26bcf478fe8feda3ec9144e42c3a27b05eae3fde08bfaddbcb5f7cb5e96acec7f280f87d7eab01345c5c5ac1e2f9251bc115fb9a6dc8ee4fcaf8ee09f

  • SSDEEP

    3072:LJJHkvG3HfqCz4obLn3NoWaVG4RN4zQj5I5NR2YyzDJpI1OJExZ:LJJEuPqCz9bLNQXIU8o0Z

  Score

  3^/10
  behavioral8

• • Target

    PhoenixC2-main/PhoenixC2.exe

  • Size

    393KB

  • MD5

    3c4161be295e9e9d019ce68dae82d60a

  • SHA1

    36447fc6418e209dff1bb8a5e576f4d46e3b3296

  • SHA256

    0f6481dabf7871823f259eb95f3b85c37d1de8a7d1884ac77a97d887cf96f75d

  • SHA512

    cfa2d491a5d28beb8eb908d5af61254ac4c4c88e74c53d5d00ae15ef0731df1654304199996545d1074814c0ea8a032957b28d70774f05347616428e667f70e6

  • SSDEEP

    12288:ndoOphZgRZGJZzu/aeZjl5FeBTCVpgTfR:ndl/QZGTuHhjFe1C3gt

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of SetThreadContext

  behavioral9

• • Target

    PhoenixC2-main/README.md

  • Size

    685B

  • MD5

    9cd835ee91ba3ce4f124a3f62c98844e

  • SHA1

    3492f41a6b1f52448ac4f07a7e9476cdc0df66af

  • SHA256

    edc6cf88bfe57013498ad610c84da2f692258f6fc83a6754cdc80d83111bb123

  • SHA512

    789b213ce8e23b0e851f79bc51854a8f30245b1a1285f20976c4e200e37e4221187a27535c363abab395df14881b0b75c920501c681179a63a07aeb53fbdbe5f

  Score

  3^/10
  behavioral10