Overview

overview

10

Static

static

3

VoiceAi_Setup.exe

windows7-x64

7

VoiceAi_Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VoiceAi_Setup.exe

  • Size

    27.4MB

  • Sample

    231123-dznqrage7y

  • MD5

    a87d0463e71627b972210ad64ed3414d

  • SHA1

    cf9eff7d77c2bdf26f9506c69fedec6ab0319844

  • SHA256

    bfdba18907857055fd1ec903098f8f7ed3514e13494ebde944704907b64179fb

  • SHA512

    e76269a6b2688b7d4e46ca5d74040e41ad1048f3019e25eeb63247a3ba7db4ea33b86625ea1f57936b7a5f7bfddd343ee7564709ce10154782167eabb072b7f5

  • SSDEEP

    786432:yMLFY30bO/f9Pj2j4N5dFU+TfgevMKHWEZYHW89r+:XY30bOHFj2kZFBTg6MKHWEOHWur+

Score
10/10
lummapersistencepyinstallerspywarestealer

Malware Config

Targets

    • Target

      VoiceAi_Setup.exe

    • Size

      27.4MB

    • MD5

      a87d0463e71627b972210ad64ed3414d

    • SHA1

      cf9eff7d77c2bdf26f9506c69fedec6ab0319844

    • SHA256

      bfdba18907857055fd1ec903098f8f7ed3514e13494ebde944704907b64179fb

    • SHA512

      e76269a6b2688b7d4e46ca5d74040e41ad1048f3019e25eeb63247a3ba7db4ea33b86625ea1f57936b7a5f7bfddd343ee7564709ce10154782167eabb072b7f5

    • SSDEEP

      786432:yMLFY30bO/f9Pj2j4N5dFU+TfgevMKHWEZYHW89r+:XY30bOHFj2kZFBTg6MKHWEOHWur+

    Score
    10/10
    lummapersistencespywarestealer

    • Detect Lumma Stealer payload V3

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks