Extracted

• • Target

    e28311342425ddf4b2ea8417eb4aa8841c36bfe40721ae44243dee371d5d3a71

  • Size

    400KB

  • MD5

    016341463c7fc28b5f760d3119525fa6

  • SHA1

    bc70fb3d885b44336aa9d6fcd458546650175cfa

  • SHA256

    e28311342425ddf4b2ea8417eb4aa8841c36bfe40721ae44243dee371d5d3a71

  • SHA512

    a0e52165c1c0126b549dfbf8aa2f8a982ddb900ce054398e65bbb7067acb02e609067ade9a175f59f4a1b1ccf9763563b700cf772c46dfd7de2382869672158a

  • SSDEEP

    6144:8FR71xbvJvVDPQUmr6fZDltEUZjsgSwEYs2g/K:8FzxbzDPbhttsgSwEf

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1