Extracted

Extracted

• • Target
    cx-programmer 9.1 free download full.exe
  • Size 2.2MB
  • SHA256 a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7
  • MD5 5ac1f7bb6b5280f344bd10d1be424a94
  • SHA1 999efe2b1a3f7d15e38395387cc13d2ebd5718a7
  • SHA512 fe9534ec93c2fd96b7038f55e0ed08d5425d84f4c6d0dc0e77b616742e362b057f60fb60e77eac4e413b746cf385b563f9c626013f6e6a2b246e7b3b52c9ab53
  • SSDEEP 24576:V5uJ/YW5d6NwLb3ezR/a4qkYDYhDEneNUUKlIA5+OQRvXGiDvIhAOPGvKlyMCfdO:V2zoh9JSqXfKyKHJvnoE7okxlEJ
  • TLSH
    T10AB56C80A9D340B2D646223290B673AB67305C0D0F3DDB53DAA5BDF9BA7F7821837645
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionlummapersistencespywarestealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2