Extracted

• • Target
    [email protected]
  • Size 14.2MB
  • SHA256 c799e5e10709df5ac5a1f7fa57757d819169eb989da0a17837852826366f0618
  • MD5 c02acc9d1f6b722db01cdebda7261f3a
  • SHA1 9dfc99b14991c753ed46daa47ebb8ab6a72b41c3
  • SHA512 b35d7d692cdb46cc11a95479aafce9986647f0c252a3c203b93dba9d095f18844f2c0803cd965082397453d22ef9c4671755182d5a7ddc31a3b6d928b88b888b
  • SSDEEP 98304:MvJ6ElnqpxqUpOCLuMl9JrI6VKn+cIzNzCuCEAdLN3qgo:UkDFCMl9qQzZCAA+5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummaexecutionpersistencespywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2