Extracted

Extracted

• • Target
    Reminder.exe
  • Size 9.7MB
  • SHA256 ebe565a1a2b13e3cbcf7bcc58ea8bee81bd1ed2fed0e5977dc9e108ee8cbae95
  • MD5 d743bb6502147d38addb430590bc7a98
  • SHA1 16cd70dd31fc54c0e42695441dbf3eab5de2e2bd
  • SHA512 b6b61e445e59f3431414a8c664ed5686d79cb01fd50e7442c869f6c94f4f4183f980de2827f1ddf70817a4dd08661281e1d050ace81c5c5b50b7dbf7a073a735
  • SSDEEP 196608:F/UI+mNZKDKmDX7HPY58yZqLcbUm4CzknrnbELh19M8pjx6gO0EMTe:F8HV7YqyZqLwqqk3E39npjZO0Eme
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeylumma322a8ddiscoverypersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2