Overview

overview

10

Static

static

1

setup.exe

windows7-x64

6

setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup.exe

  • Size

    2.0MB

  • Sample

    230720-ty96cshe26

  • MD5

    e50344cda8a69b48749d22ea64393b44

  • SHA1

    27c5e641316ee429d5e09014a19a6fd9acb77f8c

  • SHA256

    f7e848c8e9b9761a22fca2fed95705ec55e5e6ca1f9e445bbe24c481018b040a

  • SHA512

    2700b6d1a5af0319273023041718ab6c784ba7748321da6567a4f3116aadb79cdf4748a6bd557d1b0b335521f1bcfe237fa2ef480fb2239402081b5b73e2c3ba

  • SSDEEP

    49152:NGFJRV/B/ZEycm0uaKQrvrZXsxbKObCxwBD/:NkVjurZAqwBD/

Score
10/10
lummaspywarestealer

Malware Config

Targets

    • Target

      setup.exe

    • Size

      2.0MB

    • MD5

      e50344cda8a69b48749d22ea64393b44

    • SHA1

      27c5e641316ee429d5e09014a19a6fd9acb77f8c

    • SHA256

      f7e848c8e9b9761a22fca2fed95705ec55e5e6ca1f9e445bbe24c481018b040a

    • SHA512

      2700b6d1a5af0319273023041718ab6c784ba7748321da6567a4f3116aadb79cdf4748a6bd557d1b0b335521f1bcfe237fa2ef480fb2239402081b5b73e2c3ba

    • SSDEEP

      49152:NGFJRV/B/ZEycm0uaKQrvrZXsxbKObCxwBD/:NkVjurZAqwBD/

    Score
    10/10
    lummaspywarestealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks