Extracted

• • Target

    msoffice365update.msi

  • Size

    2.5MB

  • MD5

    f95336c88ee7f8b6275fac1a458dad53

  • SHA1

    79fea0be5521f44c6b3fd621fb4c95167ec7542f

  • SHA256

    e9cd2429628e3955dd1f7c714fbaa3e3b85bfaac0bc31582cf9c5232cb8fc352

  • SHA512

    aa75cdccc14381f7088bc6090029f4b36e484a4f3e3b0a60e90ded013aa258f47631f40670e200fce687c2271f89a7ef8c91926d5698291740b192927249b896

  • SSDEEP

    49152:nQgIfhlTYEO+w2/64hnPRMB0WkuqES58NtvU:3IZlEN+wK6qRMB0WkufF

  Score

  10^/10

  discoverypersistenceprivilege_escalationlummastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2