Extracted

• • Target

    98f6ecc60e016311511ce920220598b33eb9671e7c71254e76d638d0f2a45883.exe

  • Size

    18.9MB

  • MD5

    ceadf477dd0dd9681578032f4a8f9c66

  • SHA1

    b769c106316c626ae05b7aa95acd6773eb027370

  • SHA256

    98f6ecc60e016311511ce920220598b33eb9671e7c71254e76d638d0f2a45883

  • SHA512

    928149eb53d782e478175ca98bc6c5328aaa615a7076248265ff9553cabb0880fe8bffb7418d8dd4d0e13f1f38514ed47cec895e54a96e543ef19dd60b594ee5

  • SSDEEP

    393216:u1GM169wLiaLBZlZvgmPqPNerU/odSkN1p/Us6uI6baSoKIna6tIw6aqyWzdIG/E:eJ1AajFPhU/6N1p9676eSaFmH7U5

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2