General

  • Target

    5874bb1804c8f9d1f3225eebc849f8ca

  • Size

    5.0MB

  • MD5

    5874bb1804c8f9d1f3225eebc849f8ca

  • SHA1

    5712ee89188a6a2d65890ee5534b773b135726b9

  • SHA256

    e79c3dbd9b7db02103c4701f56ed7eb3cad228f266249c72d012509aaf06e5a3

  • SHA512

    5765dea7169ca4d378a2814a3d97920ccd63518cb5e739a20fc186e1564d4f2facb30c06e67505844f04c1a0ef10b13be28266a6f24423fc0ba5dba9fa460685

  • SSDEEP

    98304:QiSozLi7ouNoPOGeNp/AwtaoXhoMEnmnJSxvkYytkMvmZFZLcZyKHrh:QiSovigLeNp/A14hoMVM9cvmLmXLh

Score
10/10

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 1 IoCs
  • Lumma family
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 5874bb1804c8f9d1f3225eebc849f8ca
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $APPDATA/PPMate/PPMate/channels.xml
    .xml
  • $COMMONFILES/Synacast/SynaLive/FWUpnp.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/Har.dll
    .dll windows:4 windows x86 arch:x86

    78121377f3efa9be51d158a709dccd50


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/Live.dll
    .dll windows:4 windows x86 arch:x86

    448e135b6a3bfbd60504d98ce84fff6a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/MngModule.dll
    .dll windows:4 windows x86 arch:x86

    d5ba88d191fa4bb4a0de210b22e6ac81


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/NetTools.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/1012/KOM.dll
    .dll windows:4 windows x86 arch:x86

    7cecd1ab25c0b666f51ef269e00504e2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/1012/TEN.dll
    .dll windows:4 windows x86 arch:x86

    8d8548662be50c279e5c6801a280d58d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/1012/eroc.dll
    .dll windows:4 windows x86 arch:x86

    337fb24d346a57a9b9ada0390d9fbc99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/1012/mir.dll
    .dll windows:4 windows x86 arch:x86

    972c1fd934b3d084589974cb3bf2ec22


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/1012/tpi.dll
    .dll windows:4 windows x86 arch:x86

    90547e4eb5ec31263ac362ca3152bc21


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/GAL.dll
    .dll windows:4 windows x86 arch:x86

    34cdb0d333236a9df55e2e9e73b8b4c5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/KOM.dll
    .dll windows:4 windows x86 arch:x86

    b858d9f1031821341292c006a74a943c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/MUL.DLL
    .dll windows:4 windows x86 arch:x86

    9aaeceb8f6d61aa7caf74c2a192e81c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/PCP.dll
    .dll windows:4 windows x86 arch:x86

    f7da0542502914a50a6e3fc6a88c6309


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/PPF.dll
    .dll windows:4 windows x86 arch:x86

    28627a1cd852e3ddb1a05a6fad212cdc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/eroc.dll
    .dll windows:4 windows x86 arch:x86

    337fb24d346a57a9b9ada0390d9fbc99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/mir.dll
    .dll windows:4 windows x86 arch:x86

    7f6c25d2e4eab005f0216cd14ea5f428


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/ten.dll
    .dll windows:4 windows x86 arch:x86

    8d8548662be50c279e5c6801a280d58d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PP/tpi.dll
    .dll windows:4 windows x86 arch:x86

    90547e4eb5ec31263ac362ca3152bc21


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/PPLive.exe
    .exe windows:4 windows x86 arch:x86

    7ee8f291c029c1eab354b299ecd0d2d5


    Code Sign

    Headers

    Imports

    Sections

  • $COMMONFILES/Synacast/SynaLive/ProductUpdate.dll
    .dll windows:4 windows x86 arch:x86

    6a51de90992d98bb2ea89287f1173722


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/SynacastEWA.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    a08e4ff5c5a86ec51821580993867180


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/TaskDownload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    30248e8496f224640d3234b24b5caa46


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/TrustUpload.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0d1acbda0f20379d5b2765332ec4aec0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/am.dll
    .dll windows:4 windows x86 arch:x86

    7851a7479772b0671c92d4c8ee0217fc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/common.dll
    .dll windows:4 windows x86 arch:x86

    4af413a6eee4fec07c0985b05516f3f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/ets.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9fcff45561cdb369433d22c4865e1cc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $COMMONFILES/Synacast/SynaLive/uilib.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cc8cbe427c7a531ca3131be4170331b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • PPMPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2f5d82ada90bd0a629da13b3d9011756


    Headers

    Imports

    Exports

    Sections

  • PSNetwork.dll
    .dll windows:4 windows x86 arch:x86

    89ff9c38f56cbc4f6f5a8ed740aab1f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PowerPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4d3ffa65ed362b8a091aad83f8b30fbf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RecordPlan.exe
    .exe windows:4 windows x86 arch:x86

    0c002c2c1c5729e7133e586d5b77fd73


    Headers

    Imports

    Sections

  • Recorder.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4316aaef3652b911b4a625e3bab765b1


    Headers

    Imports

    Exports

    Sections

  • SopCore.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    74cde3a886ed38bb98935593d4cc654a


    Headers

    Imports

    Exports

    Sections

  • TVUAx.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    865d2257a426cf79da02ecf1476deed3


    Headers

    Imports

    Exports

    Sections

  • dllcheck.exe
    .exe windows:4 windows x86 arch:x86

    7bc47012256ec9788e27c7c27c1ce1c1


    Headers

    Imports

    Sections

  • kankansession.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    79a70bd459052bd14ed6ea8b542750cd


    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:4 windows x86 arch:x86

    9a8fb143a010f07506356c42d6154f05


    Headers

    Imports

    Exports

    Sections

  • libexpatw.dll
    .dll windows:4 windows x86 arch:x86

    16adaa296932ee15ea6dacef0485a6a3


    Headers

    Imports

    Exports

    Sections

  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • network.dll
    .dll windows:4 windows x86 arch:x86

    0a55738351378fa22250e32dbc64565b


    Headers

    Imports

    Exports

    Sections

  • plugin/CheckOS.dll
    .dll windows:4 windows x86 arch:x86

    0bd51211f1803ff41ceed9ab8c00dbdd


    Headers

    Imports

    Exports

    Sections

  • ppamnet.exe
    .exe windows:4 windows x86 arch:x86

    d0cdedceec699f9cb64fa91302c86a22


    Headers

    Imports

    Sections

  • ppdoctor.exe
    .exe windows:4 windows x86 arch:x86

    462eabe3a4afd28bcef939ab08a6b8b4


    Code Sign

    Headers

    Imports

    Sections

  • pplivesession.dll
    .dll windows:4 windows x86 arch:x86

    b39315c466bdeb9be81d5261407f8140


    Headers

    Imports

    Exports

    Sections

  • ppmate.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a0944c2fb20de2459834c2cabd2598a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ppmate.exe
    .exe windows:4 windows x86 arch:x86

    93dfe6a28611c7ae00a6530619585981


    Headers

    Imports

    Sections

  • ppmlist.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    dab1638e2fb9d59f861c41d1c15a1016


    Headers

    Imports

    Exports

    Sections

  • ppstreamsession.dll
    .dll windows:4 windows x86 arch:x86

    155389df29ac066fea2486418dc21303


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sopcastsession.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fd93e48d9cf1ca335bcb8b2172de8bd0


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:4 windows x86 arch:x86

    ec3469e6569d715ba5e5e1375e9767e9


    Headers

    Imports

    Exports

    Sections

  • tvuplayersession.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cc8c4f99ec1bd6abad69c5c27a4c5ae6


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • version.ini
  • xpsp2tcppatch.exe
    .exe windows:4 windows x86 arch:x86

    52208d004a89bc8f2b0dc87d13a97979


    Headers

    Imports

    Sections