Extracted

• • Target
    98030eaa87dfbbaff2f7b66fcdb9b7cc
  • Size 267KB
  • SHA256 f35d8086dba71fc501f7d1ee444d4194fc470a7b779693a08b06b17824b77f67
  • MD5 98030eaa87dfbbaff2f7b66fcdb9b7cc
  • SHA1 9accc6c2c7241194845aa61c7ed6c94953167781
  • SHA512 e84dd2ad308115aca974417fa1583c4e2454161166de4686a8dce1a7a78185720e50a401990db1f40b253bb159bb0d8d9230e744e0eebe5716283f7098d98cf5
  • SSDEEP 6144:XFrD6QHF+b9vtt7Ucy2g6Dk7hvpQSwAxM8uV4f0wsw:X96QH89vtdUbVGShlwA28uVTwj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummametasploitbackdoorbootkitpersistencestealertrojan

  • Detect Lumma Stealer payload V4

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2