Extracted

• • Target
    2bc45853aeaa522cd77ef0f534acdd9c.exe
  • Size 3.7MB
  • SHA256 3bd35fb24ae69b7d8d706d563fd42f012face0a21ff163b99b0f9574414134fe
  • MD5 2bc45853aeaa522cd77ef0f534acdd9c
  • SHA1 4927baf2b5eca7918947ca060f5f63c343441af9
  • SHA512 e610bd71ef7ee77e0fe60d2cccbdfe4a08ee39a707dc54e1e2e4ebd600f29da3120dde8511d75f81949ffbe613d075505699602e6dfe9edd2d9aabf7aec9ee60
  • SSDEEP 98304:XDC36pQhVv5OiRTIduATGzB8YA3CYCDGBBCD7U9XbcT:XDC36OhVvPuuA6+YAr6KBCvT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummaspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $INTERNET_CACHE/Assign
  • Size 215KB
  • SHA256 72f25b4beb645b415c49da4247226ecdb9b0d81d85407a1b2335d40283c91c67
  • MD5 e5d5ad8ed6f93fec6a1f393c3429fefd
  • SHA1 0171fdf86d5755a5e748dde795d794d17bae76b9
  • SHA512 1f2cb2490a001fb13c659df07bacbc1270e3201f1fc44a64a6d88e2c80482c548cb360776cac9e51a917260cfbafacc678687bfb7f7764204ecb34def9df81fd
  • SSDEEP 6144:1K5vPeDkjGgQaE/loUDtf0accB3gBmmLsiS+ST:uvG4waEqOfFfB3gBTQ+ST
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4