Extracted

Extracted

• • Target

    frick-main/bil2.exe

  • Size

    27KB

  • MD5

    2ff8e057084b5c180e9b447e08d2d747

  • SHA1

    92b35c1b8f72c18dd3e945743cb93e8531d73e2b

  • SHA256

    accdada8772018e58baa0ecb3e79c507eb09c7d67f22f59e323c74b51eac9072

  • SHA512

    7ae542c6ca36e5ed934ca503f3489144e0ec7d81ad246af88bb525cb494f6725df0aa9131c72afe79ff02364dd65ec7a3ffb01846f99836feff06746193af251

  • SSDEEP

    384:9XKCifuPVcppE4KeEdAl7H0I4GSFdr0NAbybMAf3L+9tHmXel7xI:96CiWPVypE4QalMZmoZ3Hmw7

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1

• • Target

    frick-main/bil3.exe

  • Size

    5.1MB

  • MD5

    cb1ab881df77d5e59c9cd71a042489dd

  • SHA1

    948c65951d6f888dacb567d9938bb21492d82097

  • SHA256

    23fa323eea0a8a6367e810996a54337197c1750a9a0a53c306c8c4022dd94780

  • SHA512

    84a1030a3d2f55ad6fc576bb122d98428485986c1fe4bbd41e13ac1ce588dc3f1034fbe18139f23f9422d520815b4e437b6ac7b78960d0b6c52c56acb87f9c31

  • SSDEEP

    98304:JiGUZDIMGpNQVgB6W9Yj1FbFKGZkZk0a51wYKZpptRA3x9JEY0UiHO5RcrNkjR:KGpNfB8pFbFK1G0a5k7A3LJGUiu5WJkd

  Score

  10^/10

  xmrigdefense_evasionexecutionminerpersistenceupx

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Drops file in Drivers directory

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2

• • Target

    frick-main/bilvarw.exe

  • Size

    137KB

  • MD5

    9d6c51f4f9e0132ea410b8db3c241be6

  • SHA1

    8aa67a34b626f61e6ab053f8a51e7c5142865fe4

  • SHA256

    61d2f6f7051c9b06c87e7c6f8c596b8e4d88382278e4d34d81520bc47e2cba31

  • SHA512

    479dd4703e0b462d7c0cfee5bdcaed97d8888f6c1fb04aad6e6d1a098b5a61701dd19a2635c64cb4cc77038445e5e498fdf8af75d728e5a58988047d3c4e2790

  • SSDEEP

    3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8QLGu:KH8RuRLlzgUd6a/AslLGu

  Score

  8^/10

  credential_accessdiscoveryspywarestealer

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3

• • Target

    frick-main/first.exe

  • Size

    1.2MB

  • MD5

    7f8aa520a9a7ca8f1fa0aaa149fc9c31

  • SHA1

    9b765af2678e1d7ce7517a2b226ee014625a9ab5

  • SHA256

    7e1b3e2af22b270a6b45c4218a507d37a1175a196f29969c012c3cbd8c4bcde4

  • SHA512

    94d2ea5d47c80643dd9f389467d91c25c50db0e9cd4509529481a84a0bd20d0ab23df06d6b48a050ab17646a95d22e45af6c501701d7a832e7f1f100aa1a6b4d

  • SSDEEP

    24576:rNxjovXnQAxVt6ZAhpZuI+w8rPG+CxVPw72+E9nUGA8kVJ2:rNxMvXHxVQNI4C+1UtUPg

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral4

• • Target

    frick-main/kecklowfive.exe

  • Size

    12.5MB

  • MD5

    4d9728a6c062cfa93ec0e5b18f67f436

  • SHA1

    bcf5dc9253e785c561261ccefd3b0485adaa3748

  • SHA256

    77af16a3bb1d762ceee56acc22bdf10d1945c007a4ecf6504e991f8f4e1588e9

  • SHA512

    74ea12d3537c4d520296193c9bf481a367fa382ad1d131c9d67b048911f79cfd01325da17a6eb9d88048e63b10b2bb23db98c082a68ad81d3b74576302e92537

  • SSDEEP

    393216:FMMj6uIhwiF20XBou0GmG/pUTfNF88FH8vmg2b5:CgbIBF2IaCpUTfNF8qH8vLw5

  Score

  10^/10

  xmrigdefense_evasionexecutionminerpersistence

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral5

• • Target

    frick-main/keepsix.exe

  • Size

    1.2MB

  • MD5

    22ed9403a360fff342b48189230f8ae2

  • SHA1

    f69c795e359a29a7d950b029a7adf37034acd4e3

  • SHA256

    b607b8df1ec5f07e71f3e34e5af8bf39ba6b4623dc35ad24e9b969d0a4ca3020

  • SHA512

    402059a656dc0732a5d160f8cb19212686b8d2608facf009850c74ed0ebceb4f67b9ad00f8d0d3a7347d7f419b9f1b31d8738eeaf06b13404dfd47a4abb1797b

  • SSDEEP

    24576:Iluuo0Rfz0BFtfSouF8zqYjJg7ErzQ/Y0epOe1QG2H1q8QT5TFju:IlLkvqIJg7IX0re1QzTQTTq

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral6

• • Target

    frick-main/keepthird.exe

  • Size

    1.2MB

  • MD5

    9e9726ed7bc35d41a2e66985a1113559

  • SHA1

    9757bbf91e01639c7f948c6efdfe8c6786088fcf

  • SHA256

    0a2d7e8214ea86a20490e1d5cf08481b1ba2f3f9b74ede296c3c4c1745564d8c

  • SHA512

    58328336d5e463a53d44335ce3d22dc4281effff2ad766996d8120f707eb9b5bc9ff50b4ba0a528a0c164fa3d5cbb6feabafe93f04aaa39bd83d3825e8257086

  • SSDEEP

    24576:zFrmdTm8WztCYE5SBZps42Wyz8ig9/+lZtIW+QFUaitM0RZsCoOuL:h4r6QIZpsphC/+P+QWTsCoOu

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7

• • Target

    frick-main/mineratowerst.exe

  • Size

    1.2MB

  • MD5

    1c38a4cb137587e0bdabc6f0f9da5bf4

  • SHA1

    924276f9a377383ba1ac962c33cf5eba3ab99481

  • SHA256

    0d3157d9357b842ea39662cf3ceedddeb0edbe3b563f05f0a25ccf7538c418a3

  • SHA512

    699b1bd935f4bf6baff146e91c48c8b93242047e363702306006d1976270eb64195d136fd798ccb7386d4a5f803e9c5e77fed84fec3ad9d2225fde0902bfa794

  • SSDEEP

    24576:y/AM2dzoZJiGbnKPGP+z44/F1u6r9+SaE6H0tQh/ucJs2DQxYXcbWM:nzoZJtzBPgmEtaEN2/7s22ucd

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral8

• • Target

    frick-main/newfour.exe

  • Size

    1.2MB

  • MD5

    b7a37c2f10d42243531a9f041c75c76f

  • SHA1

    7e036b1103c7d7080939fdd1807b52809b4dcea0

  • SHA256

    a1d7dd8dca14593278e924b5b8d1f3201e8aa71b9e299770186f6dfda9eea0d5

  • SHA512

    ccdfa1fda008984ffec9f799db5c5731e32a3a944c5bd23d91277b3fdd581b0122314e3eca829edc8e82534003fbd16cb00fa44234191de62d43d4a07c6e1521

  • SSDEEP

    24576:uPrk9t40j1jxXZkr1WReiDdyqM0GfxRSexq37oHq7YIgoU7gTPNetsF4I:uPrk9tFj7ZkavMTPRSexPEjo7uPNOseI

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral9

• • Target

    frick-main/nowiwkgtjawd.exe

  • Size

    1.2MB

  • MD5

    68990826d0c23198824e74689425bd44

  • SHA1

    4751460e2ec2971349eb19ef11ffda342a1955d7

  • SHA256

    0288e0fbfefb8623b2b0dac003316fc94251350e25ac4a568d4e7376820b592b

  • SHA512

    b655c3c9f44c611e1e7c4d5a90a9ed8c9f786a05623bfc41b6b0539bd5854dede0127774ceeb238e74c7976bb992988b3490d64d9e2b35044bd43be70d2813ce

  • SSDEEP

    24576:egJzVGbca5oMHgLaK8cAsL2jqWzZaoCkxdGOXkxeHl0uqeAWLb0onF/v:eg9VoQaXDGuJ1/Ckxd1lHl0upLnt

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral10

• • Target

    frick-main/second.exe

  • Size

    1.2MB

  • MD5

    eaf0cc47dce039f5390ce9c5e8f56753

  • SHA1

    884185f700e866304c3254ec9942923340bfa75c

  • SHA256

    e0b85549e6e241b3949df8971b3c5781cf7ca7c36c7254e052c034e93f53db67

  • SHA512

    2ca6b20a80fa3d2317531aaf48516f9b0cdea1493002c81c2f8d96b579322af5525c49f37568bc9c17a7f0ea65ba703ecc6ba669414813c428447cf9d16636c3

  • SSDEEP

    24576:vNZSNzog6M+tuoXRyTJ8Na1uG6lkT8iDFa/cn8e6DUj76T:vHOGBylxu7I8ivnFGW6T

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11