Extracted

Extracted

Extracted

• • Target

    d808c118c79794569869cf92a8bbcb60ed29b2815282f048da66a7ecc4e254bd.ps1

  • Size

    195B

  • MD5

    6b7cba6b3b995c043af8b5901e56db8d

  • SHA1

    b09cb6c73808259ccef2af9a9510c6f69a73f6fa

  • SHA256

    d808c118c79794569869cf92a8bbcb60ed29b2815282f048da66a7ecc4e254bd

  • SHA512

    2c0dc1824fc8e8ac2d4ba70287be4cdefb1158cb1e0bc49f739102088b07994cf2ffd4599ef169509e2a27bb8353bbffe98cb3cafbe9089df61dc69d9d762059

  Score

  10^/10

  executionlummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: AutoIT

    Using AutoIT for possible automate script.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2