Extracted

Extracted

• • Target

    e4fe2b92480a8ad512c643358c7add07588e8028c1526e5e874d292e6053d4a6.exe

  • Size

    1.3MB

  • MD5

    5dbc9dfc9cde9b0e2117b2ed82c98c8d

  • SHA1

    bdd1f983ed5640db4d1e09d1f824413c6f3608ff

  • SHA256

    e4fe2b92480a8ad512c643358c7add07588e8028c1526e5e874d292e6053d4a6

  • SHA512

    7b62eee3b9c095aaed878380678e7d1156d602c118a753182e4822ecaaf1011ec854a7c19e3f6d14238bee1a2388df9dd2902b7dc00a921d5f7ab66c49be99e4

  • SSDEEP

    24576:SxLsMs8WdkZt8L5vqLGFRGybQNuRxaIa/OozGMBN9tcI4C:2sldht8IIkQgRxaIa/pzGMH9tcI4C

  Score

  10^/10

  lummadiscoveryevasionstealertrojan

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2