Extracted

• • Target

    libb/d3d7.dll

  • Size

    39.6MB

  • MD5

    3a2a7dba9d66b18c1e6efd85afe491ad

  • SHA1

    16161e1082aade1889db12ca2cb2517831f68526

  • SHA256

    9b8efaa9a78ce15454a9912add0b4fe60354020b46cddbae0e54812468994eac

  • SHA512

    713ee0103448d1a9e90238699a2bb5a19ad765b7d09b3e3dbf60a1613b9f407bbda37808968612448f8a6684eaa11585b2c6b0817ec807eed0561c7633dc0e13

  • SSDEEP

    393216:cNBZvJ0S0l5bLFNHkFomJpXVWI3+RkjVkB/R+Hs/D8iUyEW/FxrLNHqS:cTTILDlL

  Score

  10^/10

  discoverylummastealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3

• • Target

    libb/d3d8.dll

  • Size

    39.6MB

  • MD5

    3a2a7dba9d66b18c1e6efd85afe491ad

  • SHA1

    16161e1082aade1889db12ca2cb2517831f68526

  • SHA256

    9b8efaa9a78ce15454a9912add0b4fe60354020b46cddbae0e54812468994eac

  • SHA512

    713ee0103448d1a9e90238699a2bb5a19ad765b7d09b3e3dbf60a1613b9f407bbda37808968612448f8a6684eaa11585b2c6b0817ec807eed0561c7633dc0e13

  • SSDEEP

    393216:cNBZvJ0S0l5bLFNHkFomJpXVWI3+RkjVkB/R+Hs/D8iUyEW/FxrLNHqS:cTTILDlL

  Score

  1^/10
  behavioral4behavioral5behavioral6

• • Target

    libb/d4d1.dll

  • Size

    39.6MB

  • MD5

    3a2a7dba9d66b18c1e6efd85afe491ad

  • SHA1

    16161e1082aade1889db12ca2cb2517831f68526

  • SHA256

    9b8efaa9a78ce15454a9912add0b4fe60354020b46cddbae0e54812468994eac

  • SHA512

    713ee0103448d1a9e90238699a2bb5a19ad765b7d09b3e3dbf60a1613b9f407bbda37808968612448f8a6684eaa11585b2c6b0817ec807eed0561c7633dc0e13

  • SSDEEP

    393216:cNBZvJ0S0l5bLFNHkFomJpXVWI3+RkjVkB/R+Hs/D8iUyEW/FxrLNHqS:cTTILDlL

  Score

  1^/10
  behavioral7behavioral8behavioral9

• • Target

    libb/injector.dll

  • Size

    272KB

  • MD5

    e550dcb95d5e046b6f5f5184deb0190c

  • SHA1

    6a96c753a4a7670981c7af63acb358b956f4f0c7

  • SHA256

    9a33fb8b9393fbaece093be56ffc6df082cad14b012daca8ba36de384868ceaf

  • SHA512

    a6b8b7a484004ddb7169fae93bf0a503b891f49a3235323f93fa9f7606bb8872eda59a7bb8bc622ebfe606265029c83b0d5908a9f6bb5b8c3c93476e4ed74d17

  • SSDEEP

    3072:LqRRxAyol7pPNIWxoik0ydPhSQq0elQtBmhwrK+O6CJuo5AGo/qPoD4WXk:LmW1pNIWCi3yVhSxQG4VXGr

  Score

  9^/10

  discoveryadwareevasionpersistenceprivilege_escalationstealerthemidatrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Legitimate hosting services abused for malware hosting/C2

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral10behavioral11behavioral12