Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    coderoom-main/Service.exe
  • Size 281KB
  • SHA256 31bbfded45a9815b54db6f95ea71498dc8c18eede71a3a6810bdf5b37ab5f56b
  • MD5 c6063e70d5165d1186696d84a18576b2
  • SHA1 7bfa0e4e935cdf264c84c050c717c67257a0a99f
  • SHA512 03e448e09092bd569c2ace54637d390d78af04a06e8e18d584885b8972289a95b0b637c05858d37bfc3fdbdaa23e21b18f8d06d72f60ae35ed39533b61f7715c
  • SSDEEP 3072:bjTaw17mBiuYusL/ZWNLgAlkVQFFpeC/e6PTFsNpN8LCAlSFtkSmjJ53u8mWPowV:Sifus7QniVQFFAC/PFSAGf3mNJ/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1
• • Target
    coderoom-main/biopderfawd.exe
  • Size 6.8MB
  • SHA256 d01f06838b39583de6738d8b0e9d2b7c0414b4801ccab1d71b2b03c2958a528c
  • MD5 fe820cfa43aa340205ae839e565de86c
  • SHA1 0d07304a76c97bd5096c3b1125546f02971d543d
  • SHA512 9b7a1c098018d06eb2399c20767cd45e73314cfc8e20ebd4baecdfb5031fa7358d32e42193180937523bf89656e10f4251ff9e9594e0330fa576bb6205bb0851
  • SSDEEP 98304:SHfOJnz/aIxjHwoot8th47wcE9qOL3Cmo85hlZMrLa5WaIfu0csdsWqcCh03Y:SH2jrwb8z47wcE37voChDAagp2L0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xmrigdefense_evasionexecutionminerpersistence

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral2
• • Target
    coderoom-main/biyhoksefdad.exe
  • Size 1.3MB
  • SHA256 70870a58aa5a47c9cb1e913883e8c7e08fb49c9018dc08e05af3cad3dad203d8
  • MD5 67af8a00aba060d6508df2389989d85d
  • SHA1 455950022329a0fde1bd4c3e050f1635464cdb51
  • SHA512 54eaeecc53dc31b1d4b41d0dcc5b30cac6d29f601c8d9c0bee2cde2b430ad043476faa106e5faa40de3323ebae05eeb91ab2d899c1c4b96dd067e8cd484c9472
  • SSDEEP 24576:7XH6QghP23MghHx6e3KVLYEbDsGM4hRAeXEm5UaZlnKKw3GQWGh:DHDgHuKVjfWmzDLlA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3
• • Target
    coderoom-main/boilfdsefSQ.exe
  • Size 431KB
  • SHA256 f41eafd14e60035082f6313e0f7cbbff3a6e90defe48aa3e000793b94b007e87
  • MD5 e5a997dcd4d6fc4d01ba75c6acfdc098
  • SHA1 5cd75897d56bfe125823a49720364f6674b02a31
  • SHA512 fee1c60b3f9e7dbdab90cc966921acd68a5903683d33228aa8d9a651c0ecd6b57c6ca4a12dd5aa4dede69a439f452056c4edb064206c2cc8719e2703b5e3b7a5
  • SSDEEP 6144:JIdUXq44bq4LrqMUz2y6cdjJ4nCb0KhEekcdK5xAO2XjXapGc3Fou:JIdU6tdyDJZQKhEe7WAXWp7ou
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral4
• • Target
    coderoom-main/boost.exe
  • Size 5KB
  • SHA256 86db4cd31548241c2ced14ad3d6e7949d103c09526cb89b70575cd3dcb3eb6da
  • MD5 5f330c7aa002e2fa6eb293eed9827070
  • SHA1 44e9197e3946e3182c20ab88f3dfb0ebfc89ca3d
  • SHA512 02879f1a66bce86759baff813bea3884b0d4b703470b6ff85616a431c71b74ffb2ab51219a25801b9999e93ecd48c047c0adad4655a176ecbb78922056780cd3
  • SSDEEP 48:65XV5JV1OK2oMuBQpikGKteuNMpt1lBwByNa8wz4HBfyH5UVabWbTTCtDtl+bpFD:ONV1OK2gSpbJEwUM/Q5YUVaSb2gkzNt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5
• • Target
    coderoom-main/boyjhpskdfawd.exe
  • Size 612KB
  • SHA256 3742bec392d2ec8b02a3f77594cd0f5ac303dc1a4d2eadb4821547e345333ed9
  • MD5 648e084538b7622bd34496caf04784c1
  • SHA1 f38fc56b8c3f0c11d629d30b48ccabf147333683
  • SHA512 dd1f8e8a7739a7fd6cb77bf5bc464030de1b51c33fa4524c69e12ea9173c84e0e44b167290621500f4b3df37b0096484535526d82049b547a44fb1fc5dc9d3d3
  • SSDEEP 12288:hPCznW14HnBprKl8lxxhQGYcjOZ3w1dquzu89/p7:NCznXBprtldQswyku9h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral6
• • Target
    coderoom-main/crossings.exe
  • Size 487KB
  • SHA256 c0297a465ab62db781cd06295004e14eac2d87905b5015b1cc02b446a34bf042
  • MD5 db59bfef32bc15d53bdf499dd1ae62c4
  • SHA1 e809baf170ae36169a2e2e1eac96c6283bd43b52
  • SHA512 f4c307335699f75acb1eff4ccef003d3e27ffccbf9793021881c81f370b3c1b56ee93dbc3d827f5c6e2852b261e11d9bf1270ddc7fd5b962690e163d684fddd0
  • SSDEEP 6144:HIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6GJ:H200OFp+G0imvHn3Cp6qyBP+YdsvZGo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosfirefox tsmsdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral7
• • Target
    coderoom-main/dawothjkjad.exe
  • Size 1.2MB
  • SHA256 a51011b9f87c36b6ac3c29fa310b51e0d19cda3938d1f4e61b46432d8e39969e
  • MD5 991758c06a5a177ccd6af5f29bd95046
  • SHA1 35201332aeb5fa8a9f93460c8b6c422b9501b84d
  • SHA512 2ce2b45e2f03b25e0852950e4d1b498718e9073aa6a1c5f0088f9653fa2b7069d9c9bd6281f6a38ddda7ce02366e08eefedebed68fbd42f49c1b4ba22c04341b
  • SSDEEP 24576:vf+EvcpmOZqSqXIJ3w4b22MZ0XctAfGfE99tSG1sNpHJB8n2C:3+ocwGs41lM06AOsntTC82C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral8
• • Target
    coderoom-main/fffffffsa.exe
  • Size 3.1MB
  • SHA256 e2797eec2f82e9f93bed5c70adacecab791441199814ae333c45c7bf1c70ab6b
  • MD5 ceba3115edddb819dff6e0dd35d080c1
  • SHA1 75ce40d65431629863ce6dd55bbdcc6fed821da7
  • SHA512 bfd3582863f3f107dd2c9933d69ce91fe1e5db332f968d772db998fd9a146b7caadd88b1dd5c8e5c3bc404d7d5ef8967a963fec65c8ea2cb48425167e0131917
  • SSDEEP 49152:sPvhU/6SJEDEQenaDlLlDz2Q4kMQjD1rcZ46Q/EKkpgurSzGIBQ3PaCUa3YAWM:sPpy6SJmKOlLlcKD1ws8eu9n3j
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  credential_accessdiscoveryspywarestealerupx

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral9
• • Target
    coderoom-main/fun.exe
  • Size 6KB
  • SHA256 e572f5c5137fc96f2c7472069fc96b12285c3467385d113dc7ffef21a8e226e5
  • MD5 3eb3ebece2c0e0d6b2be4ec64ed0509c
  • SHA1 44359c3314ddae27a90106d3c1be44f7d008261f
  • SHA512 efba74eee95bcd545e3e58261b5cf6bd1842b2d01ab465c2d36f741cf84dc87cb5ba5443a55527d8b6edcf04077030910d8d50118147fb9d6291edc2108f1437
  • SSDEEP 96:DqQZXJH7/ataW0T+DZjaxOk3jQEdRqBzNt:DbFJBW0T6ZGxOk3jQww
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral10
• • Target
    coderoom-main/jthkadktjhja.exe
  • Size 1.2MB
  • SHA256 c3efd5418abf873a15fbce5e230bb81ef09a0ca01f39c483b5086d2854c760a0
  • MD5 1b95cb89010eb9b1e170aad0385b6ee2
  • SHA1 2d3fe7b72f884f6ea8e286d4a0c29233e0e85098
  • SHA512 3864cf8655f8e1e05214778a24a4c92d6f4fe02b4f8a2122784d20cb549a05e569ad2e3c8f1328919e840ccbe6af1256bb79599a2d7f7614723c08d93ee664e2
  • SSDEEP 24576:ihGcBHlXqRoyjEtPg/Ajv5HCmgRT2lP+/9awru0RP22mvu4Z0ihRDwcn6PwQP:TcBHVyo1LZCWJDOVRP22QuE9hRDwcmb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11
• • Target
    coderoom-main/jtijhkasdjrhg.exe
  • Size 538KB
  • SHA256 077364482914188a642ea8de919005104d1609840ac543f6479bf63fc3c54d67
  • MD5 a0c0ee4d7de0c9cac81661a23530bafb
  • SHA1 b2027c880471cfc27de4465c0f008b8cb6038a84
  • SHA512 449dc825e4daa0b108b0362c15dce8599f6a78863b3f25fd3076812f89183f69ff64e7c458ac0ad0b427868b6cc89d6e9d6e8c9bb9495786fbc31472026e191f
  • SSDEEP 6144:EYqdc0NkzDV4L3eTIlA41qpcN3p0NIb88WsNMPaKFP3b2V122J0sL:E9J8+jPycN3CNIb88WsNMP5F1k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoveryspywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral12
• • Target
    coderoom-main/monrealetrussoa.exe
  • Size 1.3MB
  • SHA256 1f3227891f6009399911bd4b45509cabae874807a3557348890a7cc0055973bb
  • MD5 a3b6b2d3c89dfa65fa6d61798f8ca670
  • SHA1 0ff6bb9be4a137b477bde9f297e8d14c5379c385
  • SHA512 684e35b03a1baa3ba3954b1851a54ebfa3f3b20c2542d8d857297249e4d03f6a0d98c5342b94b186ff331dd4f0b12b2f1f9ef62c8e7f376288e4318244fd690a
  • SSDEEP 24576:DiL9EzuF7sCuiMg/mrpBFeoIUxlFQxPaufCfztGMMqN37rWbiVRYi1NKgLc:D8sutsCuimVBFeoItx8EM9rWiFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13
• • Target
    coderoom-main/mvtijadjtrhawd.exe
  • Size 1.3MB
  • SHA256 d63d458494c853be3e861c15d6a206990e1f13d9551ac700b1265151faab20e2
  • MD5 f1cddf5591ac025c3af911319e1a51f7
  • SHA1 c0f2c2accb99cfdf09522f2fee12d451b3692c0c
  • SHA512 522bded624be8141e9dc4ad110ad65bcac95989519475d9da86129571e85b8b871532c16a1563db644d1e4f7e4fefb0c6cf693e8dc4bb2bceaa0b5c4b44a42b8
  • SSDEEP 24576:wkuGD0eGx0lGXL3SQzCeTBFX3EfzJJDufWDPLt5qKFGEvRzSRVVwH5/nODh5S50o:luGD0eGawb3+eT3X0MWH1FG6eG/Oy5fz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral14
• • Target
    coderoom-main/nbtoaesudjajwd.exe
  • Size 3.1MB
  • SHA256 cfdf1d2768ed773c3f5b2c2a03d7892551ea79b181068c23a765f1e09a8c90b1
  • MD5 baa1353f2955138fe781da218ecfbfec
  • SHA1 951164e7150e31d64d1770ec8903a39caddf2009
  • SHA512 ce1fb896c9d2ccaeabb04bc0d0d84665d6e312cba388a4360e636fa2ef7907905af6aa4e1826053d0dbecd99db206c017604849c482a10cd1aa1c6f1b3a47b76
  • SSDEEP 98304:VFRopLT6zpNrQePFVACFD0MCqjub5uWij5nMyP8O:8LT6tNcODFYMgBitnfk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  credential_accessdiscoveryspywarestealerupx

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15
• • Target
    coderoom-main/nbtypsfikkad.exe
  • Size 6.8MB
  • SHA256 76de12fc1c2446150168ccb2520dea6b5f30ab53fb5cfae8926abcebf5c8364d
  • MD5 8bbc3cca3905e7ada419a806de48006c
  • SHA1 d9527797784197257a37c743da36f4de8197e924
  • SHA512 66f9d6bd184be4e70acda9ea2a5757fb6ff31e76cf895b01143e2fbf3a342f1a14492ef8ad08ba27f323ab1ede351eab7f1f57efa35ef7978a2e80442d11bfcd
  • SSDEEP 196608:FMk+nb1nuqMbwhIEkfnpmLA9EFRJouTX:FSrkfnsLAeRr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral16
• • Target
    coderoom-main/nbvtojsdawh.exe
  • Size 1.3MB
  • SHA256 cb888774ee7f7ddf235b38e08b267ddb86bd9458b6e8701593a871977033e3f3
  • MD5 347f809ee23c43c837f31a1f3faea31e
  • SHA1 483ce5fd414d27c0db77a62082ca9eac9417e618
  • SHA512 718817ddb5a5ed4a2a77bf00fc3979e5904cb4eb1a85682172ce738dd652498ac8586223d92da2bfe81508042266db3d84f39d56ef8b6b9290f020132c910111
  • SSDEEP 12288:UDN1ULnJjGfpoAJiy8/PoiMWOLonc8EvrHaFykDsdj9HdP97pqI0wD9GqzsahPq6:UhIslJT8/v8ku5L8KTD+oiQrr/61+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dcratdiscoveryinfostealerrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • DCRat payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral17
• • Target
    coderoom-main/nbyosapefdkhasd.exe
  • Size 830KB
  • SHA256 708b90620e944806d2ad832646b09f6b94d64935fb1eb6c056ac6da6049055d4
  • MD5 bac01e445ee98d0f5786cbe5db0b5af1
  • SHA1 c425da1b35f88971c74396faea1456eb2e57c1ab
  • SHA512 494a4add1138834bd48817f99a2726b3cd80c1800bc036da44517063562e6de2a0a2ba90e810538e2482f47e6317609f8d36a4954a69280355f006b9e6276a68
  • SSDEEP 12288:RPl1fce/+C4pmDH5ejE3wKI5wzuuGhP/Sknk7HtxCxXGLzz+Y3Q9TEbuX61+:RdJSpMEjn19qNaDX61+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dcratdiscoveryexecutioninfostealerpersistencerat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral18
• • Target
    coderoom-main/nobtpajdjthawd.exe
  • Size 922KB
  • SHA256 c1a4e75659105f547ab3ed1d3cd2b159f59841db1d77288601d005655132fe22
  • MD5 37866be1ef3af2eb9f96671722a52ccf
  • SHA1 bc5fe4fed193686eee771c729c4d4144988e652e
  • SHA512 cc8c0aeed01223eb458a0c2c538bfb457d83d0220176b79495eb9cff9e52074af93f25681081933398f00b6c79009e3e7237808e3be59f68562c0b4ed5ca9b06
  • SSDEEP 24576:3fW/iayD+nYAcFyS13cfrf5GGGIt1rq7IUk:3TlDcYAcgY3XlsdGIUk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral19
• • Target
    coderoom-main/nogtpjadthaw.exe
  • Size 1.3MB
  • SHA256 f4aa315f8ff0c107dce56c88112e061f4e6260682eaf0ffc42a5bcf0d5fd6b8d
  • MD5 2e070594f72d17abe15d822aca9f7d40
  • SHA1 4d9ed6638bcf8749e2de2a42f379c81781e63e77
  • SHA512 1f5251136f144d95da7578ae02f896c11dd7d59b2abb485ffe896a899044d2140e9609326ccfeafabf3f0c2d14adf562c72af03923bbe59a631865fdd9f5dc2e
  • SSDEEP 24576:1jASJswj6381I/N9/hhgfzDoTxrp6TFwu2kBL3ryop:1cSw81I/oHgxrp6BwuH+o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral20
• • Target
    coderoom-main/ntohlasdlrg.exe
  • Size 363KB
  • SHA256 cfb21d5e810fd19a459bb7f099ce1095c8811cf0674e4d7940f6ca2d29593a9f
  • MD5 fbc3147905f3dad4828a8f0fe07b557d
  • SHA1 46f73ab06c67a4214e8ceced910cf4ca618a5b6b
  • SHA512 8c82e6e3ea07403ce7cddb110df26c7388caa52088e4699b530615a87f45053f7687b0045b4ee4c870ee83b9820631059c34dfa8b58d53283d5c4e2617789ff2
  • SSDEEP 6144:NvnDvkb760jsiLwHwMGeOypBUK/4q6Pt236RttQyjBjz3J+AOza+eHpLipm:VnDv50ATwreGE6k3MtQkz3II+26
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryexecutionspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral21
• • Target
    coderoom-main/ntohlsakdth.exe
  • Size 2.4MB
  • SHA256 77f89edc608310294fb98dd03be1c1b855482cebf1222b7bed671f59961f1b52
  • MD5 47a277db4adbef8222b360460c39a313
  • SHA1 b213b2ffb02d3b3a145e9325ffe37803e89c8657
  • SHA512 880f2341c2f71062b2e8fa4e0023d6afd880b7d0f419c7299abc5e8f5c69847bc66ea3542116c9a6f755fe34c3f55f6292d3d5c94498b9645e0e33a5ad7fae10
  • SSDEEP 24576:s0QPOqTLvACw7sULd3yUJVd4CUGgblBiIRXmfpbsNP0gSClSiSLpHDcr1TY6D+:FQPNTLv20KAzXdP0dISFmT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dcratdiscoveryinfostealerratspywarestealer

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • DCRat payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral22
• • Target
    coderoom-main/nyoilsafkjawd.exe
  • Size 487KB
  • SHA256 fa1c16a3024d35ebc4f6996d1791ead89a08dae2ebd87e39c9997c04613c4645
  • MD5 0bea38a3f664f5c8d72ab74db022aacd
  • SHA1 d185b86120ea6fcae137edcff25547fda2b6d4a5
  • SHA512 22089f02f5d941ff4ea4f0fdbf3c7b2cdfdb3bacfda7ac3151dd87d68621fa550c0bf3c13e0d512aa5f5823e8f786b13d12c7ea4699574a895c31b3d6f85de42
  • SSDEEP 12288:P200OFp+G0imvHn3Cp6qyBP+YdsvZGH3:e0Zp+ViehBWY0ZS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosfirefox mtsdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral23
• • Target
    coderoom-main/oyjijsfjjtyhad.exe
  • Size 538KB
  • SHA256 b3f87af043d22e844171b6bf66e4a6d966d880c0dd8e8aa61f25ac382546b3af
  • MD5 bd0fdaabed40d16fffeac608d7a68822
  • SHA1 f2a5d6a2be78424dc598ebb636401add7f2feef9
  • SHA512 4db0cfb69e03d0658874389180bdac7c20d75565fbd77ec9adffb00ce59250ef036497bc9cf46383baa449528ba1208bdfbfc06f06c45df94fbc348612f3f45f
  • SSDEEP 6144:sYqdc0NkzDVUTfmTIlA41tBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J8qjXLcN3CNIb88WsNMP5F1k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral24
• • Target
    coderoom-main/thawdtyh.exe
  • Size 486KB
  • SHA256 78cc96452121dc657a87c79561272f3669f781d24265a7a2ab853a5670fff80d
  • MD5 cf8c5debe04e96be1a022ce0796d868b
  • SHA1 f91900f49ea42776bcbd81f59b656740a01b9cf3
  • SHA512 4ceb541f8162f370bd2dcedd3a8335cc4f40bb5d4ec8232ece4d0d685c9a1a663f9edfdccbb480b8c13d24dc8fc961da4d31dad1ad538aa6442b339167b732e9
  • SSDEEP 6144:JIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6UJ:J200OFp+G0imvHn3Cp6qyBP+YdsvZGC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosnew newdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral25
• • Target
    coderoom-main/vktyhkakwdrg.exe
  • Size 1.3MB
  • SHA256 d5acf2451a1683b2e702f8da1dee3c0c908f6683b899e5ebe8b4614f1870a410
  • MD5 bc270342cd8a60fbcb34f401914fe1c4
  • SHA1 0f30f3e48550f1e1ebcb46d48c7d7a50499352b9
  • SHA512 42dfa739a610a7fe073256dfb1a52a517dc35989b5c40c631fbfbf36ba5307c2e9c84bd855f01b46d1ffa625214ea0d496f4337ee61d38cbcd1e46be7b5005d4
  • SSDEEP 24576:3AECXHcTq2XPHhxRX1PVUZli+wa2iMQXU4TL+sNgC6BvRNFE4Fe3EknBrxgXf:wEC33Yrqq+FXRToC6fNV43Eknvi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral26