Extracted

Extracted

• • Target

    nonia.exe

  • Size

    6.9MB

  • MD5

    cd2b81a5b3709ce225dd36155fcc03ff

  • SHA1

    79392c7e57ea1638c45e889130a42ac01cd989cd

  • SHA256

    1ba86c6926a17e77c941f65901e97d88b20bf2508e1d75adf2495344022c4511

  • SHA512

    5813cd0596d3d2b799538e0404a9a7141c4cc764737c04e0402f27c34ed3d076641f255b7420fd662fbb5a73cf287b810e314888709cea7709bbfb13cfeeebc4

  • SSDEEP

    98304:rt2cot2nE0QOVqf0oisTLhLh/ExNqoT3K4zLuY7CqwGg/KqC4g5SZtmaoXAPn54E:rtnit0odL//ExNqoTaALuHwoQa

  Score

  10^/10

  cryptbotlummadefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2