Extracted

• • Target
    a4bdf08099f23da066d81eddb1c229d1
  • Size 119KB
  • SHA256 6a3faf643c2c33f48b0e59c9edb14baebbf9ce1678aed83727106b739f0cafcb
  • MD5 a4bdf08099f23da066d81eddb1c229d1
  • SHA1 bcd16532c813e5ba009d4d3cd246796d3ffb7a45
  • SHA512 b5cca53eab5ff8db14cb53262de2dda2730f8149b51366a55bd4bef3c4501e594000edc4695ca61154e768609be0333898a9586f2840df6a23aaa54cd0abc69e
  • SSDEEP 3072:hIZopSB/iLm7CEdYVgfIYCBP04+i6Hz3qFlhH0ytpAGf:VpSBt7CE+gfIhM4l6Hz3qFlJ0cei
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummametasploitbackdoorevasionpersistencestealertrojan

  • Detect Lumma Stealer payload V4

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Looks for VMWare Tools registry key

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2