Extracted

• • Target

    2025-02-27_d4e3642f6aa005d56c42e3eff6cfaa2a_frostygoop_poet-rat_ramnit_sliver_snatch_zxxz

  • Size

    16.2MB

  • MD5

    d4e3642f6aa005d56c42e3eff6cfaa2a

  • SHA1

    3603be6d330152d747be6eeff5c626b3df669a26

  • SHA256

    f49dd4cad24b109d38ef6548c48188ec4db6c16a3086fe200124433e6b3262d5

  • SHA512

    677816dc3baa5685c60315ed1f000b61ffadfa5c8e973b79acf314c7d72b5f9fbf8ed1c6a40e02f0168b59528bdf2c88f2b265981d5e44860e5189b5c771da7b

  • SSDEEP

    196608:qeXaEgT/xxqZbtQBu1rw1aUsvrsSmeaoK:T+0JQEBw1aUsvrsSTaoK

  Score

  10^/10

  ramnitbankerdiscoveryspywarestealertrojanupxwormlumma

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2