Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    rihuata-main/alopernutsa.exe

  • Size

    1.3MB

  • MD5

    740f90748595efb8d155732d1c4a9f10

  • SHA1

    ddca6847a8092fc19a473d483284fc39291bef4b

  • SHA256

    7a5551bd343f4f626e394df465d366fd7ee6e42cd80c24ddbc95b766d20aa28c

  • SHA512

    a2fcda91c75b17f176968e73f0b5127af3073a19c5fab546dd6134bf4d6d0fba3ff82e908aa45b5e6c3507344b0133b21aace1f367a57cb11b3ec4088d52e226

  • SSDEEP

    24576:fHY1ynXyuZNhKCjlD2EQyjQrKVNi7bxpL7tamKHW90j428Tqhn:/wOoKVNQt3Krj42wqhn

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    rihuata-main/ausritter.exe

  • Size

    5.1MB

  • MD5

    cb1ab881df77d5e59c9cd71a042489dd

  • SHA1

    948c65951d6f888dacb567d9938bb21492d82097

  • SHA256

    23fa323eea0a8a6367e810996a54337197c1750a9a0a53c306c8c4022dd94780

  • SHA512

    84a1030a3d2f55ad6fc576bb122d98428485986c1fe4bbd41e13ac1ce588dc3f1034fbe18139f23f9422d520815b4e437b6ac7b78960d0b6c52c56acb87f9c31

  • SSDEEP

    98304:JiGUZDIMGpNQVgB6W9Yj1FbFKGZkZk0a51wYKZpptRA3x9JEY0UiHO5RcrNkjR:KGpNfB8pFbFK1G0a5k7A3LJGUiu5WJkd

  Score

  10^/10

  xmrigdefense_evasionexecutionminerpersistenceupx

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Drops file in Drivers directory

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2

• • Target

    rihuata-main/bobobopepep.exe

  • Size

    137KB

  • MD5

    eef0cf1e11cb3f28d745ea4147fc6d90

  • SHA1

    da5e2f874cde6c4e8fa39acc0b4006fe97030881

  • SHA256

    a4f6c7683dfaf5495456684359e73c8decdac1435ab742763ad1fe7260f775b9

  • SHA512

    0b79b6cc0bb84011b5d0b80251a83188682e057d58c9c700886eb482d491d4593b1891dcd840f3fefe164adefae9f3641e2f03372390efba926e12581df8789b

  • SSDEEP

    3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8Qrqu:KH8RuRLlzgUd6a/Aslrqu

  Score

  8^/10

  credential_accessdiscoveryspywarestealer

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3