Extracted

Extracted

Extracted

• • Target
    ff90a3408afbf8b9881e45e77e72276d.exe
  • Size 2.3MB
  • SHA256 6445781c5d6b6f6cb7d283e46a89a3e55ea6b2c84ebf89fabfc75fc17f3f649e
  • MD5 ff90a3408afbf8b9881e45e77e72276d
  • SHA1 886dbb7aeb73f135b242c78a3546c468a322d3ee
  • SHA512 01191d8634eb989c70ebb142ec1db01ab03e1f334b1facf37f5d7c2181b469572f30ee0a9490d6e8b816f80974b638af931cdee7c16897fcd96c016a8a1f1b81
  • SSDEEP 49152:qBtFsBzK+3kDT7chqBcJnd44iiXCFi8ht+SF3xc/P7jJ:OtFjDTlcJK4H+hZF3x2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeylumma8d33ebcollectiondiscoveryexecutionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist

    discovery
  behavioral1