Extracted

• • Target

    https://bazaar.abuse.ch/download/a65b290aa9ebfb82746cf75440c19956169f48d7dcbebafde6996c9b46039539/

  Score

  10^/10

  lummaevasionpersistenceransomwarestealertrojanvmprotect

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1