File name:

@!!Se-tUp_2244_PassW0rD$!.rar

Full analysis: https://app.any.run/tasks/efcb60bd-4006-436c-a86c-2d2193266d06
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: November 05, 2024, 07:57:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
amadey
botnet
golang
crypto-regex
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0288709E9ABEB331D93B022944CFFD2A

SHA1:

90EC578579999E4F9221CE7F5530426A5F180693

SHA256:

8AA6804E6F2075B042C2CAE7FE71E83B246B04018F909B5ACF98165BEC6DB9E2

SSDEEP:

98304:9IIGUikrbUqHohhkOFlbDTjArllgdILd+WeiGs/iWY+fuY3rVglj3WPFyg6l4ALI:CkM3Z51LNCtD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Connects to the CnC server

      • svchost.exe (PID: 2172)
      • explorer.exe (PID: 540)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)
      • Kleenka.pif (PID: 2312)
    • Changes powershell execution policy (Bypass)

      • Kleenka.pif (PID: 2312)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7152)
    • Stealers network behavior

      • svchost.exe (PID: 2172)
    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 540)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3764)
    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6724)
      • choice.exe (PID: 2708)
      • Kleenka.pif (PID: 2312)
      • AutoIt3.exe (PID: 3644)
    • Starts application with an unusual extension

      • choice.exe (PID: 2708)
    • Contacting a server suspected of hosting an CnC

      • Kleenka.pif (PID: 2312)
      • svchost.exe (PID: 2172)
      • explorer.exe (PID: 540)
    • The process executes Powershell scripts

      • Kleenka.pif (PID: 2312)
    • Starts POWERSHELL.EXE for commands execution

      • Kleenka.pif (PID: 2312)
    • Connects to unusual port

      • MicrosoftEdgeUpdateCore.exe (PID: 6568)
    • Found regular expressions for crypto-addresses (YARA)

      • MicrosoftEdgeUpdateCore.exe (PID: 6568)
    • There is functionality for communication over UDP network (YARA)

      • RVRQ7VQ4T65IAQIJN.exe (PID: 6204)
    • Starts itself from another location

      • Kleenka.pif (PID: 2312)
  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3764)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3764)
    • Application based on Golang

      • MicrosoftEdgeUpdateCore.exe (PID: 6568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
20
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe setup.exe nc.exe no specs icacls.exe no specs conhost.exe no specs choice.exe conhost.exe no specs #LUMMA kleenka.pif #LUMMA svchost.exe THREAT rvrq7vq4t65iaqijn.exe no specs powershell.exe no specs conhost.exe no specs choice.exe no specs conhost.exe no specs autoit3.exe microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs THREAT microsoftedgeupdatecore.exe #AMADEY explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
540C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
choice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\twfjhopuqwievk
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
1204C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exenc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2312C:\Users\admin\AppData\Roaming\Kleenka.pifC:\Users\admin\AppData\Roaming\Kleenka.pif
choice.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 1
Modules
Images
c:\users\admin\appdata\local\temp\mjsjudquyx
c:\users\admin\appdata\roaming\kleenka.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
2648"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\@!!Se-tUp_2244_PassW0rD$!.rarC:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2708C:\WINDOWS\SysWOW64\choice.exeC:\Windows\SysWOW64\choice.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3644"C:\Users\admin\AppData\Local\Temp\G9AU8U\AutoIt3.exe" "C:\Users\admin\AppData\Local\Temp\G9AU8U\Afflicted.a3x"C:\Users\admin\AppData\Local\Temp\G9AU8U\AutoIt3.exe
Kleenka.pif
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 1
Modules
Images
c:\users\admin\appdata\local\temp\g9au8u\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
3764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\@!!Se-tUp_2244_PassW0rD$!.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4408C:\Users\admin\AppData\Roaming\acon\YJBDCGJZXFUAIWRZOCBOFPZK\nc.exeC:\Users\admin\AppData\Roaming\acon\YJBDCGJZXFUAIWRZOCBOFPZK\nc.exeSetup.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
1
Version:
8.0.3810.9
Modules
Images
c:\users\admin\appdata\roaming\acon\yjbdcgjzxfuaiwrzocbofpzk\nc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exechoice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 127
Read events
12 097
Write events
30
Delete events
0

Modification events

(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000004602040000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000680204000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F00000000000000000000000000000000000000000009E0204000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(3764) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3764) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3764) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\@!!Se-tUp_2244_PassW0rD$!.rar
Executable files
17
Suspicious files
10
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2708choice.exeC:\Users\admin\AppData\Local\Temp\mjsjudquyx
MD5:
SHA256:
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\dvatransport.dllexecutable
MD5:C56CB2A849C920137088A6191D86C6BC
SHA256:5E12D3CF38ED4CAC63129F421633E2E78548722EC3ED34B6463A6840DB01A59F
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\dvamarshal.dllexecutable
MD5:4160806637A8913BD1917D00D1845018
SHA256:8B0828A82448079B9936A317775AFAECE313679241442EA4EBD1CA06BE64D10D
6724Setup.exeC:\Users\admin\AppData\Local\Temp\7cf9ebd2image
MD5:D0C7C8492CBDC1656F76DB3EF16B9738
SHA256:9264CE029A9AF385FCA15C2864D14520D3CBA1CD752A7BD1994BD18E6F4952F2
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\gcmnqbinary
MD5:F7482EDC812EB88E7399537BF44BB901
SHA256:D72DB0724BF8DEC609178C82456B2E1E0312CA30C0FF722DEBBB1C379FCD18CB
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\dynamiclink.dllexecutable
MD5:7041B2530FC2B325A7733865D157633A
SHA256:19B5D563D307EE0386065CA840B802D52FB04FE820E471C23534B5B362DC82BB
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\dvanet.dllexecutable
MD5:5790ABD90395C121EFA8B6D7A615F050
SHA256:6C154B0E07F2A7A8DAFBCA6610FFC4B50899ED815A3A27F8F9F87D5EB99F1ADD
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\bipijheabr
MD5:CEC4B1C4100FDBD2E8BA169FDA09EC63
SHA256:BDE2D2287C65F45C8080915172A018D29A599A1020F55FB0E38463AB3EBE5AAE
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\msvcp100.dllexecutable
MD5:BC83108B18756547013ED443B8CDB31B
SHA256:B2AD109C15EAA92079582787B7772BA0A2F034F7D075907FF87028DF0EAEA671
3764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3764.26162\boost_date_time.dllexecutable
MD5:E4862728552671212C86B50470710BEB
SHA256:83A6FF307C32692F8775302315295E6A814701D5A617621C25B935CF9660D50F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
53
DNS requests
31
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
632
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3960
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6228
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
3960
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
2312
Kleenka.pif
GET
200
142.250.185.227:80
http://c.pki.goog/r/r4.crl
unknown
whitelisted
2312
Kleenka.pif
GET
200
142.250.185.227:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
540
explorer.exe
POST
200
104.21.23.211:80
http://moviecentral-petparade.com/g9jvjfd73/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4836
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4360
SearchApp.exe
2.23.209.176:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4020
svchost.exe
239.255.255.250:1900
whitelisted
4
System
192.168.100.255:138
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
www.bing.com
  • 2.23.209.176
  • 2.23.209.181
  • 2.23.209.177
  • 2.23.209.167
  • 2.23.209.171
  • 2.23.209.173
  • 2.23.209.166
  • 2.23.209.175
  • 2.23.209.179
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.64
whitelisted
th.bing.com
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.171
  • 2.23.209.167
  • 2.23.209.181
  • 2.23.209.176
  • 2.23.209.173
  • 2.23.209.175
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (proggresinvj .cyou)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2312
Kleenka.pif
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (proggresinvj .cyou in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
7 ETPRO signatures available at the full report
No debug info