Extracted

• • Target
    Mia_Khalifa 18+.zip
  • Size 67.8MB
  • SHA256 3729104fc485ea9c5a752f6de9226ad5add663f528b8114050d0f958a68ae774
  • MD5 48bde2cde8d0239e50da3612ccb0cc51
  • SHA1 9b3fec60f264dcd99a31141c8a2bcb0a09f2bff6
  • SHA512 fd78a61b32d2fa1aeae80b375189b84d3e30852bdf770b78c4c6d05a91d02c196872da8c71a09058f812e07c4faaf1f699a58ab606a84cddf2baa2818bcaaee9
  • SSDEEP 1572864:QITfzLPkhaZfjzOo534Y9Qocnw5p78Lx6rP514ReSHneyISp:QGfH3yo5x9Jcnw5pIteBeMSHeo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Mia_Khalifa 18+.msi
  • Size 64.5MB
  • SHA256 bfa7a13a97f61cc63ae748ad806978d11391a5c17b1a8a8f4fbaadf07f4e0891
  • MD5 a347250844a6e54c27bd5fcc464dae85
  • SHA1 3b27a896233eb882d1475f773836bf69d1c3bddf
  • SHA512 9b9b3776ee46ed61bb9ecf8b9c04a4607097c88a873616ab83b21c5a1fde304424191d5399899b1665f9d99824d3243e3cc29a9358a857872c93f7e6aa0a5935
  • SSDEEP 1572864:Y4pJnZxr9EOH5skMiNRvKT8SVNWX/nNKRtYA3X8gHAn/VIK:YgJL3svi3iTNVNWX/n0rDnNgn/G
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    Xmls/afterRiggersDiopter/abject/crewcutMottlesApsis.xml
  • Size 6KB
  • SHA256 84ae0abd4a34a99f842bff84b2f46a87ee7fc31bd7fef1fe26ae8a360a63d6cd
  • MD5 2e681f1273646f4edc4fe18999d6bac3
  • SHA1 a2dbd6dc6154f21d2c14daf81ca553c195b904e6
  • SHA512 5402c88601903b771b4d066a8c95d2d6dd720f30938a169c65a0bcfa82f1fb22db72930003fa332c916a35d9396b94aa6552f5952b12357749633e5fb638fa7a
  • SSDEEP 96:bVsVtiqqQ2HWAjdDKoGDMtygw2BJwXvebxM90SvVcpgkdnXzz4uCMR4D8r4m:bqVtiD2ApnGomkJ0veuNWpx1PCMi8r4m
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Xmls/afterRiggersDiopter/abject/crown.xml
  • Size 1KB
  • SHA256 167d2193455b222535dc0b407ecc89d8d21264f27f54e73f46678c12a8f5e4d0
  • MD5 f32330b28b594c9709737e040860d07a
  • SHA1 13f5c49419f25948333a03f95dfa097062601ff8
  • SHA512 a8f9182162e40efcffb4b80161be719e70daf37c2ecb13351571bd2882b85952ea1dfa6314aa25290f10c57fb07828fb0d905db032139c044237dcf7ca960996
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral7behavioral8
• • Target
    Xmls/afterRiggersDiopter/abject/cyclismCome.xml
  • Size 17KB
  • SHA256 1c976f43a49b6bd3a359b26a6d4497ab09a74ebfedb892dadc0d3d6738d4838d
  • MD5 2fd4fe94862dc235193b60c7495b090f
  • SHA1 2dc3a3bafdf8c6158375df62dbeefe0365b75d22
  • SHA512 999a03156354ef69a4240da26b04ac6615503d83cdf2d0edd031d4b28627039cdd11b1fdc3f3efa14e402941eed1eb1ee32b6038360167c75d9abd8ca29e73f8
  • SSDEEP 384:u36v4dTQORj5Xj8e1p4i4VQ5B7Bfu4k9awMn9cplnKpt:Vv+z8OpJfu4EM2plA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10behavioral9
• • Target
    Xmls/afterRiggersDiopter/abject/displeChopsSwine/jugums.xml
  • Size 12KB
  • SHA256 8c9814d79f81b23582483c7f87c3f437720babbd78b220b9e67ea1b96730a3b1
  • MD5 9f10ac7b57ce4d7732ee8586221b108e
  • SHA1 bdd67b913a351fb14cc6cf90d8e5d5f55d6c73a4
  • SHA512 069282547e8a7a4fdb665a84fe74258681f43474a30618e384dcf0eff765afae176995a0b645d684343adea25f2e8f1c758dedf39f1fc2910750796a79ded2d8
  • SSDEEP 192:IGcSxM1z0xnicDTQNvNYxY972GcWZNa50g784gRSB3riGalZg9i1OQQWMok4JNtG:Iu97Th0FU06KRSB3riGalGMeokI0x
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12
• • Target
    Xmls/afterRiggersDiopter/abject/displeChopsSwine/stagily.xml
  • Size 14KB
  • SHA256 51d3c05432d85752b5679a65bf8082c678d542402137d2957043dc072cd87d3e
  • MD5 8aee0744874d9c79f20f8945fc8ebb88
  • SHA1 50d85d57bec8588f5e75955676ce8b95fab2e2ce
  • SHA512 ba65028d4e9f320e1762857a1cd6dbd7e82d0b8805ff4f14d95fa13d538f19fcba120ae12054f6c808ddf69f7f032e6c2bb99d4775355e56b907703fe173f80c
  • SSDEEP 384:o5f1Ekw7uMnQI5vgos263aVue5uUPmwbA3laVy+0H4lQN4eJP:o5yHQIl7MD1wbA37zLP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13behavioral14
• • Target
    Xmls/afterRiggersDiopter/abject/encaumaNickery.xml
  • Size 8KB
  • SHA256 be380ff217e8272c6aeaa3ae087c4fa7afda164f442a6965cfbcd306426bf722
  • MD5 d6e5b4dee43b0f756b7dbfa7e51492ce
  • SHA1 86e1249cbc3e90ebb1fe0e23a95ebd68ff9477d0
  • SHA512 c6079421e15de41b441a8b98a15ff51a94223e6f9adbb0a32c1e36d0de5b1bdc3722b49f2cc57dd9f81c397edfd2df174840cfa7470b1cbb65f971ffaa3a5488
  • SSDEEP 192:MUHZX1rrPgBBZ/ems3dScd98c1+rJNmiFRz3dtPoTgjdL8hf:M0fG5s3dScb12DBz3dtPoTg58R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    Xmls/afterRiggersDiopter/abject/jujuistPuisneRadion/glucideAnsuAmorino.xml
  • Size 14KB
  • SHA256 b64392123a97e0635fd95912ac4968a8cc191e3e068096384624e57c2538464b
  • MD5 eb69200039aeee901555490ea5e5268c
  • SHA1 0fda4a998c30e71a4a8fc4078ead3d16c9efe475
  • SHA512 2cfc6fa21a0953f40a09248ba9fa56e627ff194b5ecce9298936b3d43c93671baf460df9e559d70c0e698f09ac147d9d051c2040e4925944b05a010ee25a879c
  • SSDEEP 192:wwJ4ejK9Ve8b/9J5qCI5o01/yUUKDATcx9xpJUAnY4SdvwO6LX5wMEzlqCkFMcso:xJ4e9w/FI5oh4JUuQRVnnX5gb61EDLt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral17behavioral18
• • Target
    Xmls/afterRiggersDiopter/abject/jujuistPuisneRadion/indowed.xml
  • Size 7KB
  • SHA256 884bb95933d70b2e45675f78e7c92b207b4454157d09ebfa98a6e8f3d1fc74cd
  • MD5 672447d4c7db5118af141beaf061f42b
  • SHA1 9af3a5f0a5d43960b154dd99d35eb188c2e2f6cd
  • SHA512 06bf8795f0589b9f9770809a753fa6423cab52611fdc8c0714043343d40294d985c17dd4f1a8cbb3a3801505483f31c9d892ee77a6da75df740d153b70c8b72f
  • SSDEEP 192:UN85TFT06LWmYE2MvePfJss0YHMO/U0ChX7T67bqz:E80mYE2MvePfJss0YHH/uhP67be
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20
• • Target
    Xmls/afterRiggersDiopter/abject/jujuistPuisneRadion/kelliesPreceptPrecept.xml
  • Size 12KB
  • SHA256 f6e4e24eb60179ac3a7bde91226c53d2a4dea03aa993bd277179819decffc6f5
  • MD5 a3bab4c6a013c634feb14147d36088c7
  • SHA1 df7b24eda38ff572d0ee5b5f93d7c25d4aa06d73
  • SHA512 a20238d014de8cdc27b92327a4ded7518b73de76787bf72393f859b9a0b25b55a92b67b2e6ccbcafb92447ee6eb5991e2e19299a6dfb571ab0d99798b5765694
  • SSDEEP 384:7bO6U03r9EtsJ4wiNnf5+hVzdkEdsFCVrYZsNP+L:7vZ3r9E64wieVzdxiCg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21behavioral22
• • Target
    Xmls/afterRiggersDiopter/abject/jujuistPuisneRadion/mirthsMiskinTeameo.xml
  • Size 173B
  • SHA256 214bd3c916dfc9fd428ba9c646b868b92309fe2c5c8bdf6633c3be9dfadf33d0
  • MD5 ece2daf8568f6bc576ca70a1e2684e57
  • SHA1 9d11ec72a8bbbae419967cabc51010f08be583db
  • SHA512 db725c7be9c77bca5481340ce31969691d0e2a506b452242bbbfca4a58812b88110c71e6366f76a8586de453bd70ae0f80caa721a8172ab4fa19565a91e5ee2f
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral23behavioral24
• • Target
    Xmls/afterRiggersDiopter/abject/pictury.xml
  • Size 9KB
  • SHA256 edda4569c9699ee026e862032059d7d9ec07da4365552ad772187dbdac9729e2
  • MD5 ab4c95e81d92ea4a09616b02506c4d8c
  • SHA1 5cd7ac91aefb165bc6bc004a7279ede0798b62f2
  • SHA512 cb0bf1a694eea098a97b631a23cb115e9206d19ab6064ba2df443465af6db4422015f8e9fe67a61424023a7f5cc67ac11e9b30d2e37294a3ec3c455ed0e09af9
  • SSDEEP 192:D7SoxRdkQGZyLBKh8RNiqkkXdZCLpk5iR907Q7ZRVA0LVHkp8EsFD/1:D5xRdkQGZoKhwNpkkXdGkkRc0k8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25behavioral26
• • Target
    Xmls/afterRiggersDiopter/agynary.xml
  • Size 2KB
  • SHA256 3f88bf4164403d766daf9883a297a63ff52253d02824c845c4e1df0202e1dcc6
  • MD5 3f0de8a11f36b2de439a4b1b370da8ef
  • SHA1 dc6ef0fa8538c1c6265b4e13c36ae5aa19f5b31c
  • SHA512 844bfe592d99ed0db76bd07748d78f1dfd2c9b32d187e4fc5a93bd16722e2a2112f5873e960464d9400f0fffef81cb379abdc1c4b748958b31d9972ba281e261
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral27behavioral28
• • Target
    Xmls/afterRiggersDiopter/destry.xml
  • Size 15KB
  • SHA256 8082064679bf44a7f0f1591e63ecb9e451360a8a86b6505d3d515d4467c6f917
  • MD5 91b2869d5f6d3ddb6cf87203110de52d
  • SHA1 cab99b48b61caa91bfaea1e44c3c81615695089d
  • SHA512 6d0b6084c487ed833ee354c99a3668cbadca8c143f40f47f0607c182c0342cb1bc0d2040bde142b7e3b69cff3559f493b85a6cecd8584215736999480fa05833
  • SSDEEP 384:/MtEsG5UnpjGINSmCWKEQuyZ7nmaYDg8O95k3mnud:/MtEzIjGuSMKEVgmaeg8u5k3mnud
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29behavioral30
• • Target
    Xmls/afterRiggersDiopter/emeril.xml
  • Size 7KB
  • SHA256 e9b9a8cbff9af2177f82f57528d4612a9a3cd7a3f7d8546f5df7083bf66b34b5
  • MD5 d56cc07ba32eb384eca38b0cb7aaa86f
  • SHA1 367f7f4888b1a35524c4ebc65bd2cc96ef4115fc
  • SHA512 b952b45b3dbbe891dba404d4011d3478cc394506724bdb043128e85a697242942286e698739b119328bb78f6cf570327beceba135324ee761259e0b58c3560ba
  • SSDEEP 96:wRFWQgk7S0z2Kjy3QC5c/L251sZiIVIZry5d5vTBeNKKpWRvKGbQYvL8aBWOO2Zx:NRk7S0z9GGC51vIVIZKTBw14RJP5WX2f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral31behavioral32