Extracted

Extracted

• • Target

    lionda.exe

  • Size

    7.2MB

  • MD5

    9a66454e4c0feb4cd1bebc8871aa850e

  • SHA1

    cc7975b8807f3d72067dc8452a3098a0f6097f25

  • SHA256

    7f186c311fc66ceb1f59beba9e6f9bb07a00fba7994d85c760848753adf1129d

  • SHA512

    b90c7b5e77d0a465fa6872904d9ed752adfeae1671329c4414c61a5182643d9b9cf2add6c9f3d014ab24583eef441c7ff3c7acd6419855b9eacc85b3d7b0c932

  • SSDEEP

    98304:0kN4q49j3XvABCrK0/cjTSsbLwnzrROD18uB0H8oy5OW:67zyCpcTSTROBHB0c/A

  Score

  10^/10

  cryptbotlummadefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2